Skip to content

chore(deps): update all non-major dependencies - #1801

Open
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major
Open

chore(deps): update all non-major dependencies#1801
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/all-non-major

Conversation

@renovate

@renovate renovate Bot commented Jul 27, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package Change Age Confidence
@module-federation/enhanced (source) ^2.8.0 → ^2.8.1 age confidence
@module-federation/rsbuild-plugin (source) ^2.8.0 → ^2.8.1 age confidence
@module-federation/storybook-addon (source) ^6.0.16 → ^6.0.17 age confidence
@playwright/test (source) 1.61.1 → 1.62.1 age confidence
@rsbuild/core (source) ~2.1.8 → ~2.1.9 age confidence
@rslint/core ^0.7.1 → ^0.7.2 age confidence
@rspress/core (source) ^2.0.18 → ^2.0.19 age confidence
@rspress/plugin-algolia (source) ^2.0.18 → ^2.0.19 age confidence
@rspress/plugin-api-docgen (source) ^2.0.18 → ^2.0.19 age confidence
@rspress/plugin-llms (source) ^2.0.18 → ^2.0.19 age confidence
@rspress/plugin-preview (source) ^2.0.18 → ^2.0.19 age confidence
@rspress/plugin-rss (source) ^2.0.18 → ^2.0.19 age confidence
@rspress/plugin-sitemap (source) ^2.0.18 → ^2.0.19 age confidence
@rspress/plugin-twoslash (source) ^2.0.18 → ^2.0.19 age confidence
@rstest/adapter-rslib (source) ^0.11.4 → ^0.11.5 age confidence
@rstest/core (source) ^0.11.4 → ^0.11.5 age confidence
@shikijs/transformers (source) ^4.3.1 → ^4.4.1 age confidence
@storybook/addon-docs (source) ^10.5.4 → ^10.5.5 age confidence
@storybook/addon-onboarding (source) ^10.5.4 → ^10.5.5 age confidence
@storybook/react (source) ^10.5.4 → ^10.5.5 age confidence
@storybook/vue3 (source) ^10.5.4 → ^10.5.5 age confidence
@types/lodash (source) ^4.17.24 → ^4.17.25 age confidence
@types/react (source) ^19.2.17 → ^19.2.18 age confidence
@types/react-dom (source) ^19.2.3 → ^19.2.4 age confidence
heading-case ^1.1.3 → ^1.1.4 age confidence
pnpm (source) 11.17.0 → 11.18.0 age confidence
pnpm (source) >=11.17.0 → >=11.18.0 age confidence
preact (source) ^10.29.7 → ^10.29.8 age confidence
storybook (source) ^10.5.4 → ^10.5.5 age confidence
svelte-check ^4.7.3 → ^4.7.4 age confidence
svelte2tsx (source) ^0.7.58 → ^0.7.59 age confidence
vue-tsc (source) ^3.3.8 → ^3.3.9 age confidence

Release Notes

module-federation/core (@​module-federation/enhanced)

v2.8.1

Compare Source

Patch Changes
module-federation/core (@​module-federation/rsbuild-plugin)

v2.8.1

Compare Source

Patch Changes
module-federation/core (@​module-federation/storybook-addon)

v6.0.17

Patch Changes
microsoft/playwright (@​playwright/test)

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}
🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});
New APIs
Browser and Context
  • New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.
Actions
  • New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.
Network
Evaluation
Command line & MCP
Reporters
  • The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:
// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});
Announcements
  • ⚠️ Debian 11 is not supported anymore.
Browser Versions
  • Chromium 151.0.7922.34
  • Mozilla Firefox 153.0
  • WebKit 26.5

This version was also tested against the following stable channels:

  • Google Chrome 151
  • Microsoft Edge 151
web-infra-dev/rsbuild (@​rsbuild/core)

v2.1.9

Compare Source

What's Changed
New Features 🎉
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rsbuild@v2.1.8...v2.1.9

web-infra-dev/rslint (@​rslint/core)

v0.7.2

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Document 📖
Other Changes

Full Changelog: web-infra-dev/rslint@v0.7.1...v0.7.2

web-infra-dev/rspress (@​rspress/core)

v2.0.19

Compare Source

Highlights

🤖 Guide AI agents from generated Markdown

When SSG-MD is enabled, every generated Markdown page now starts with an agent-readable directive pointing to llms.txt, llms-full.txt, and the Markdown version of the current page:

> For AI agents: the complete documentation index is available at https://example.com/llms.txt, the full documentation bundle is available at https://example.com/llms-full.txt, and this page is available as Markdown at https://example.com/guide/index.md.
image

This extends the existing HTML hint to Markdown output. Its URLs automatically respect siteOrigin, base, locale, and version prefixes, helping agents discover the right machine-readable content from either format.

Documentation: SSG-MD · injectLlmsHint

Related PR: #​3544

🎨 Add icons to generated sidebars and navigation

Use icon to display an image, inline SVG, emoji, external URL, or data URL before sidebar and navbar labels. Auto-generated sidebars support icons on groups, items, and section headers through _meta.json or page frontmatter, while navigation icons can be configured through _nav.json or themeConfig.nav.

For a local image, place it in public and reference it with an absolute path:

[
  {
    "type": "file",
    "name": "introduction",
    "label": "Introduction",
    "icon": "/icon.png",
    "tag": "new"
  }
]

Icons render before the label, while an existing tag remains on the right.

image

Documentation: Sidebar icons and tags · nav · sidebar

Related PR: #​3554

⚡ Speed up lastUpdated on large sites

Rspress now resolves Git history for all documentation pages in one batched pass instead of spawning one git log process per page. Existing lastUpdated configuration remains unchanged:

import { defineConfig } from '@​rspress/core';

export default defineConfig({
  themeConfig: {
    lastUpdated: true,
  },
});

In the PR benchmark, Rspress resolved metadata for its 208-page documentation site with two Git processes in about 300 ms. This avoids the process storms that could make large sites spend minutes resolving page metadata.

Documentation: lastUpdated

Related PR: #​3545

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞
Refactor 🔨
Document 📖
Other Changes

Full Changelog: web-infra-dev/rspress@v2.0.18...v2.0.19

web-infra-dev/rstest (@​rstest/adapter-rslib)

v0.11.5

Compare Source

What's Changed

New Features 🎉
Performance 🚀
Bug Fixes 🐞

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

@Timeless0911

Timeless0911 commented Jul 27, 2026

Copy link
Copy Markdown
Contributor

failed due to microsoft/playwright#41571

@renovate
renovate Bot force-pushed the renovate/all-non-major branch from 2e74f82 to 63a61f6 Compare July 28, 2026 10:44
@renovate renovate Bot changed the title chore(deps): update dependency @playwright/test to v1.62.0 chore(deps): update all non-major dependencies Jul 28, 2026
@renovate
renovate Bot force-pushed the renovate/all-non-major branch 9 times, most recently from c792781 to 7713bee Compare July 31, 2026 16:50
@socket-security

socket-security Bot commented Jul 31, 2026 •
edited
Loading

Copy link
Copy Markdown

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action Severity Alert  (click "▶" to expand/collapse)
Warn High
Potentially malicious package (AI signal): npm @module-federation/node is 60.0% likely malicious

Notes: This code is a federated chunk loader that executes JavaScript fetched from remote URLs (via eval) and code read from the filesystem (via vm.Script(...).runInThisContext()), then installs the resulting modules into the Webpack runtime and runs their runtime. The absence of visible integrity/allowlisting checks makes it critically dangerous if an attacker can influence chunk identifiers, remote entry resolution, or federation globals. Overall, the behavior strongly matches a runtime remote-code-execution mechanism rather than a benign utility.

Confidence: 0.60

Severity: 0.90

From: pnpm-lock.yaml → npm/@module-federation/rsbuild-plugin@2.8.1 → npm/@module-federation/node@2.7.48

ℹ Read more on: This package | This alert | What is AI-detected potential malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Given the AI system's identification of this package as malware, extreme caution is advised. It is recommended to avoid downloading or installing this package until the threat is confirmed or flagged as a false positive.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@module-federation/node@2.7.48. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

Warn High
Potentially malicious package (AI signal): npm @module-federation/sdk is 60.0% likely malicious

Notes: This code is a high-risk remote code execution loader. It fetches JavaScript from attacker-influenceable HTTP(S) URLs and executes it inside Node using vm (runInThisContext for script code and SourceTextModule.evaluate for ESM), while explicitly providing a real require function via eval('require') to the executed payload. It also exposes loaded contexts on globalThis under a computed key derived from attrs. Unless upstream strictly authenticates/allowlists remote origins and locks down loaderHook/attrs inputs, this represents a serious supply-chain/remote-execution threat.

Confidence: 0.60

Severity: 0.90

From: pnpm-lock.yaml → npm/storybook-react-rsbuild@3.3.4 → npm/storybook-vue3-rsbuild@3.3.4 → npm/storybook-addon-rslib@3.3.4 → npm/@rsbuild/plugin-stylus@2.0.1 → npm/@rsbuild/plugin-preact@2.0.0 → npm/@rsbuild/plugin-tailwindcss@2.0.3 → npm/@rsbuild/plugin-react@2.1.0 → npm/@rsbuild/plugin-babel@2.0.1 → npm/@rsbuild/plugin-less@2.0.1 → npm/@rsbuild/plugin-vue@2.0.1 → npm/@module-federation/enhanced@2.8.1 → npm/@module-federation/rsbuild-plugin@2.8.1 → npm/@module-federation/storybook-addon@6.0.17 → npm/@rsbuild/core@2.1.9 → npm/@module-federation/sdk@2.8.1

ℹ Read more on: This package | This alert | What is AI-detected potential malware?

Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev.

Suggestion: Given the AI system's identification of this package as malware, extreme caution is advised. It is recommended to avoid downloading or installing this package until the threat is confirmed or flagged as a false positive.

Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@module-federation/sdk@2.8.1. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

@renovate
renovate Bot force-pushed the renovate/all-non-major branch 4 times, most recently from c230308 to 25b189d Compare August 2, 2026 05:43
@renovate
renovate Bot force-pushed the renovate/all-non-major branch from 25b189d to 99ee4bb Compare August 2, 2026 10:27
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Timeless0911