Bump the minor-and-patch group across 1 directory with 16 updates

[dependabot]

Bumps the minor-and-patch group with 16 updates in the / directory:

Package	From	To
axios	1.18.0	1.18.1
bignumber.js	11.1.4	11.1.5
smol-toml	1.6.1	1.7.0
@vitest/browser	4.1.9	4.1.10
@vitest/browser-playwright	4.1.9	4.1.10
@vitest/coverage-istanbul	4.1.9	4.1.10
@vitest/coverage-v8	4.1.9	4.1.10
@vitest/ui	4.1.9	4.1.10
esbuild	0.27.7	0.28.1
globals	17.6.0	17.7.0
msw	2.14.6	2.15.0
playwright	1.61.0	1.61.1
rollup	4.62.0	4.62.2
tsx	4.22.4	4.23.1
typedoc	0.28.19	0.28.20
vitest	4.1.9	4.1.10

Updates axios from 1.18.0 to 1.18.1

Release notes

Sourced from axios's releases.

v1.18.1 — June 21, 2026

This release focuses on Node HTTP adapter fixes, safer AxiosError serialisation, runtime/type correctness fixes, documentation updates, and dependency maintenance.

🐛 Bug Fixes

• AxiosError Serialisation: Made AxiosError#cause non-enumerable to prevent circular JSON serialisation failures when errors include nested causes. (#10913)
• Node HTTP Adapter: Guarded socket.setKeepAlive for proxy agent streams, accepted path-only URLs when socketPath is configured, deferred environment proxy handling to Node, and explicitly passed maxBodyLength through to follow-redirects. (#10917, #10930, #10942, #10993)
• Runtime and Type Correctness: Fixed several runtime crashes, type definition mismatches, and incorrect error handling paths. (#10959, #11021)
• AxiosURLSearchParams: Switched the encoder callback to an arrow function so encoder.call(this) receives the AxiosURLSearchParams instance correctly. (#11019)

🔧 Maintenance & Chores

• Documentation: Documented sensitive headers and status transition behaviour, prepared cleaned-up docs, added Deno install instructions, and clarified that request data is request-specific (#11007, #11010, #11023, #11025)

• Dependencies: Bumped vite, rollup, form-data, js-yaml, and multer across the root project, docs, smoke tests, and module test workspaces. (#11011, #11012, #11013, #11014, #11015, #11016, #11017, #11026)

🌟 New Contributors

We are thrilled to welcome our new contributors. Thank you for helping improve axios:

• @​webdevelopersrinu (#10913)
• @​sijie-Z (#10993)
• @​bartlomieju (#11023)
• @​JSap0914 (#11019)

Full Changelog

Changelog

Sourced from axios's changelog.

Changelog

Commits

• a209bfb chore(release): prepare release 1.18.1 (#11027)
• fa6a55e chore(deps-dev): bump multer from 2.1.1 to 2.2.0 (#11026)
• 40e7be8 docs: clarifies that request data is request-specific in axios (#11025)
• a446b39 fix(AxiosURLSearchParams): use arrow function so encoder.call(this) receives ...
• cf1306a docs: add Deno to install instructions (#11023)
• b32880a fix: incorrect use of error (#11021)
• 1792eda fix: ensure maxBodyLength is explicitly passed to follow-redirects (#10993)
• 30499d6 fix: various runtime crashes and type definition mismatches (#10959)
• 20ce9c4 fix(http): defer env proxy handling to Node (#10942)
• e64bcf9 chore(deps): merge branch 'v1.x' into tests/module/cjs (#11014)
• Additional commits viewable in compare view

Updates bignumber.js from 11.1.4 to 11.1.5

Changelog

Sourced from bignumber.js's changelog.

11.1.5

• 05/07/26
• #409 toFraction returning a sub-optimal rational approximation.

Commits

• 275cd85 v11.1.5
• 9202071 Merge pull request #409 from chatman-media/fix/tofraction-suboptimal-approxim...
• See full diff in compare view

Updates smol-toml from 1.6.1 to 1.7.0

Release notes

Sourced from smol-toml's releases.

v1.7.0

This version slightly changes the behaviour of stringify: integers beyond the safe range are always emitted as float numbers.

String decode logic has been rewritten, it is a bit faster now and uses a single-pass approach instead of a dual-pass approach as it did previously. The code should be a bit smaller too, though I didn't actually measure that.

The package is now published with source-maps, declaration-maps, and a copy of the original TypeScript source files. This will improve your DX if you're like me and like Ctrl+Click'ing things a lot. ;)

What's Changed

• improve performance of the string decode logic by @​cyyynthia
• fix(stringify): emit integer-valued numbers beyond the safe-integer range as floats by @​spokodev in squirrelchat/smol-toml#56
• publish source-maps, declaration-maps, and original source files by @​cyyynthia
• miscellaneous repository maintenance tasks by @​cyyynthia

New Contributors

• @​spokodev made their first contribution in squirrelchat/smol-toml#56

Full Changelog: squirrelchat/smol-toml@v1.6.1...v1.7.0

Commits

• a62f06f revert: keep using vite 7
• 89aa9a3 chore: remove prepare script
• 17c7974 chore: make devEngine more lax w/ node version
• e5280a3 ci: checkout repo first
• 241c256 chore: version bump
• 0bfe7f4 chore: build cjs with rolldown instead of esbuild
• e0620ab chore: fmt
• 96114cb test: add tests for large integers
• f4537b6 fix: handle missed edge-cases in string parse
• 7b39aed chore: include source files in published package
• Additional commits viewable in compare view

Updates @vitest/browser from 4.1.9 to 4.1.10

Release notes

Sourced from @​vitest/browser's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• 5c18dd2 fix(browser): check fs access in builtin commands [backport to v4] (#10680)
• See full diff in compare view

Updates @vitest/browser-playwright from 4.1.9 to 4.1.10

Release notes

Sourced from @​vitest/browser-playwright's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• 5c18dd2 fix(browser): check fs access in builtin commands [backport to v4] (#10680)
• See full diff in compare view

Updates @vitest/coverage-istanbul from 4.1.9 to 4.1.10

Release notes

Sourced from @​vitest/coverage-istanbul's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.9 to 4.1.10

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• See full diff in compare view

Updates @vitest/ui from 4.1.9 to 4.1.10

Release notes

Sourced from @​vitest/ui's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• See full diff in compare view

Updates esbuild from 0.27.7 to 0.28.1

Release notes

Sourced from esbuild's releases.

v0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.1

• Disallow \ in local development server HTTP requests (GHSA-g7r4-m6w7-qqqr)

  This release fixes a security issue where HTTP requests to esbuild's local development server could traverse outside of the serve directory on Windows using a \ backslash character. It happened due to the use of Go's path.Clean() function, which only handles Unix-style / characters. HTTP requests with paths containing \ are no longer allowed.

  Thanks to @​dellalibera for reporting this issue.

• Add integrity checks to the Deno API (GHSA-gv7w-rqvm-qjhr)

  The previous release of esbuild added integrity checks to esbuild's npm install script. This release also adds integrity checks to esbuild's Deno install script. Now esbuild's Deno API will also fail with an error if the downloaded esbuild binary contains something other than the expected content.

  Note that esbuild's Deno API installs from registry.npmjs.org by default, but allows the NPM_CONFIG_REGISTRY environment variable to override this with a custom package registry. This change means that the esbuild executable served by NPM_CONFIG_REGISTRY must now match the expected content.

  Thanks to @​sondt99 for reporting this issue.

• Avoid inlining using and await using declarations (#4482)

  Previously esbuild's minifier sometimes incorrectly inlined using and await using declarations into subsequent uses of that declaration, which then fails to dispose of the resource correctly. This bug happened because inlining was done for let and const declarations by avoiding doing it for var declarations, which no longer worked when more declaration types were added. Here's an example:

  // Original code
  {
    using x = new Resource()
    x.activate()
  }
  // Old output (with --minify)
  new Resource().activate();
  // New output (with --minify)
  {using e=new Resource;e.activate()}

• Fix module evaluation when an error is thrown (#4461, #4467)

  If an error is thrown during module evaluation, esbuild previously didn't preserve the state of the module for subsequent module references. This was observable if import() or require() is used to import a module multiple times. The thrown error is supposed to be thrown by every call to import() or require(), not just the first. With this release, esbuild will now throw the same error every time you call import() or require() on a module that throws during its evaluation.

• Fix some edge cases around the new operator (#4477)

  Previously esbuild incorrectly printed certain edge cases involving complex expressions inside the target of a new expression (specifically an optional chain and/or a tagged template literal). The generated code for the new target was not correctly wrapped with parentheses, and either contained a syntax error or had different semantics. These edge cases have been fixed so that they now correctly wrap the new target in parentheses. Here is an example of some affected code:

  // Original code
  new (foo()`bar`)()
  new (foo()?.bar)()
  // Old output
  new foo()bar();
  new (foo())?.bar();

... (truncated)

Commits

• bb9db84 publish 0.28.1 to npm
• 9ff053e security: add integrity checks to the Deno API
• 0a9bf21 enforce non-negative size in gzip parser
• e2a1a71 security: forbid \\ in local dev server requests
• 83a2cbf fix #4482: don't inline using declarations
• 308ad74 fix #4471: renaming of nested var declarations
• f013f5f fix some typos
• aafd6e4 chore: fix some minor issues in comments (#4462)
• 15300c3 follow up: cjs evaluation fixes
• 1bda0c3 fix #4461, fix #4467: esm evaluation fixes
• Additional commits viewable in compare view

Updates globals from 17.6.0 to 17.7.0

Release notes

Sourced from globals's releases.

v17.7.0

• Update globals (2026-06-22) (#345) 33b75f9

---

sindresorhus/globals@v17.6.0...v17.7.0

Commits

• a19670c 17.7.0
• 9611620 Update actions (#346)
• 33b75f9 Update globals (2026-06-22) (#345)
• 887dd52 Fix build script (#344)
• See full diff in compare view

Updates msw from 2.14.6 to 2.15.0

Release notes

Sourced from msw's releases.

v2.15.0 (2026-07-08)

Features

• sse: invoke finalize on response stream end (#2741) (7fae0cc0954b20c739ae8e95a24eefc8a78710e8) @​kettanaito

v2.14.7 (2026-07-07)

Bug Fixes

• sse: proper logging for concurrent requests (#2762) (5c0ae1c334a0cbe52638bd2949540372be3d46ba) @​kettanaito

Commits

• 49d9d47 chore(release): v2.15.0
• ed88583 test(finalize): use expect.poll vs waitFor
• 7fae0cc feat(sse): invoke finalize on response stream end (#2741)
• db818ee chore(release): v2.14.7
• 418854a chore: upgrade @ossjs/release
• 5c0ae1c fix(sse): proper logging for concurrent requests (#2762)
• 3016bda test: fix flaky ws.clients.browser.test.ts
• 0df6d6a test: fix flaky in-flight-request.test.ts
• ff6836b chore: pin github actions to commit sha, update pnpm (#2761)
• 8a19d54 chore: improve github actions security (#2747)
• Additional commits viewable in compare view

Updates playwright from 1.61.0 to 1.61.1

Release notes

Sourced from playwright's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• See full diff in compare view

Updates rollup from 4.62.0 to 4.62.2

Release notes

Sourced from rollup's releases.

v4.62.2

4.62.2

2026-06-19

Bug Fixes

• Do not add spurious side-effect-free external imports to chunks when using minChunkSize (#6411)

Pull Requests

• #6411: Skip side-effect-free external imports when hoisting is disabled (@​morgan-coded, @​lukastaegert)
• #6416: refactor(rust/parser_ast): extract property AstConverter write buffer kind logic to new method (@​fabianbernhart, @​lukastaegert)

v4.62.1

4.62.1

2026-06-19

Bug Fixes

• Preserve multipart file extensions when deconflicting output chunks (#6408)
• Fix an issue where getLogFilter would match additional logs (#6415)

Pull Requests

• #6393: Use import attributes for importing JSON (@​selfisekai, @​lukastaegert)
• #6408: fix: insert conflict numbers before first extension in multi-extension filenames (@​LeSingh1, @​lukastaegert)
• #6415: fix: advance value past wildcard prefix before suffix check in getLogFilter (@​JSap0914, @​lukastaegert)
• #6417: chore(deps): update msys2/setup-msys2 digest to 66cd2cc (@​renovate[bot])
• #6418: fix(deps): update minor/patch updates (@​renovate[bot], @​lukastaegert)
• #6419: chore(deps): update dependency eslint-plugin-unicorn to v66 (@​renovate[bot])
• #6420: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)

Changelog

Sourced from rollup's changelog.

4.62.2

2026-06-19

Bug Fixes

• Do not add spurious side-effect-free external imports to chunks when using minChunkSize (#6411)

Pull Requests

• #6411: Skip side-effect-free external imports when hoisting is disabled (@​morgan-coded, @​lukastaegert)
• #6416: refactor(rust/parser_ast): extract property AstConverter write buffer kind logic to new method (@​fabianbernhart, @​lukastaegert)

4.62.1

2026-06-19

Bug Fixes

• Preserve multipart file extensions when deconflicting output chunks (#6408)
• Fix an issue where getLogFilter would match additional logs (#6415)

Pull Requests

• #6393: Use import attributes for importing JSON (@​selfisekai, @​lukastaegert)
• #6408: fix: insert conflict numbers before first extension in multi-extension filenames (@​LeSingh1, @​lukastaegert)
• #6415: fix: advance value past wildcard prefix before suffix check in getLogFilter (@​JSap0914, @​lukastaegert)
• #6417: chore(deps): update msys2/setup-msys2 digest to 66cd2cc (@​renovate[bot])
• #6418: fix(deps): update minor/patch updates (@​renovate[bot], @​lukastaegert)
• #6419: chore(deps): update dependency eslint-plugin-unicorn to v66 (@​renovate[bot])
• #6420: chore(deps): lock file maintenance minor/patch updates (@​renovate[bot], @​lukastaegert)

Commits

• 8faa187 4.62.2
• a38a795 refactor(rust/parser_ast): extract property AstConverter write buffer kind lo...
• 6cc5c31 Skip side-effect-free external imports when hoisting is disabled (#6411)
• caacf70 4.62.1
• d1e8297 Add missing ignore
• 1ba1fc2 fix: insert conflict numbers before first extension in multi-extension filena...
• 532bd0a Use import attributes for importing JSON (#6393)
• 2cd8194 fix: advance value past wildcard prefix before suffix check in getLogFilter (...
• dfac590 fix(deps): update minor/patch updates (#6418)
• 1d6db3d chore(deps): update dependency eslint-plugin-unicorn to v66 (#6419)
• Additional commits viewable in compare view

Updates tsx from 4.22.4 to 4.23.1

Release notes

Sourced from tsx's releases.

v4.23.1

4.23.1 (2026-07-13)

Bug Fixes

• support tsImport after global preload (8d4ffc2)
• watch: avoid clearing piped output (95d0672)
• watch: treat script and dependency paths literally (79fddde)

Performance Improvements

• index transform cache lazily (e818ad6)
• load esbuild lazily in CLI (d067938)
• map Node TypeScript formats directly (cdcc623)
• use sync module hooks on Node v22.22.3+ (f8992f1)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.0

4.23.0 (2026-07-03)

Bug Fixes

• avoid redundant filesystem probes during module resolution (257bbbb), closes privatenumber/tsx#809

Features

• add multi-scenario startup benchmark suite (c178197), closes privatenumber/tsx#809 #809 hi#signal privatenumber/tsx#145 #809

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.22.5

4.22.5 (2026-07-02)

Bug Fixes

• isolate hook state per async module.register() registration (a305f36)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 79fddde fix(watch): treat script and dependency paths literally
• e818ad6 perf: index transform cache lazily
• cdcc623 perf: map Node TypeScript formats directly
• d067938 perf: load esbuild lazily in CLI
• 95d0672 fix(watch): avoid clearing piped output
• 6fd4607 docs: add per-page metadata
• f4176d8 docs: generate sitemap
• 8d4ffc2 fix: support tsImport after global preload
• f0e89b2 docs: document Node's public type-stripping API vs internal loader path
• f8992f1 perf: use sync module hooks on Node v22.22.3+
• Additional commits viewable in compare view

Updates typedoc from 0.28.19 to 0.28.20

Release notes

Sourced from typedoc's releases.

v0.28.20

Features

• Group/category section headings (<h2>) in the default theme now include an id attribute so they can be linked to via fragment identifiers (e.g. modules.html#classes), #3029.
• Added a @reexport modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, #3096.
• API: Introduced generateOutputsBegin and generateOutputsEnd events on Application for plugin use.

Bug Fixes

• When --emit none is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, #3078.
• Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, #3103.
• A @hidden tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, #3111.
• Custom @group and @category titles with the same sort weight are now ordered consistently with the alphabetical reflection sort, #3120.

Thanks!

• @​greymoth-jp
• @​jonathanhefner
• @​kcastellino
• @​Metbcy
• @​StoneCypher
• @​wotan-allfather

Changelog

Sourced from typedoc's changelog.

v0.28.20 (2026-07-05)

Features

• Group/category section headings (<h2>) in the default theme now include an id attribute so they can be linked to via fragment identifiers (e.g. modules.html#classes), #3029.
• Added a @reexport modifier tag to have TypeDoc convert variable/type references as a re-export instead of a new symbol, #3096.
• API: Introduced generateOutputsBegin and generateOutputsEnd events on Application for plugin use.

Bug Fixes

• When --emit none is used, TypeDoc will now report warnings about missing relative paths previously reported when rendering, #3078.
• Improved performance via asynchronously performing git and file write operations, more performant JSX rendering, and source code bundling, #3103.
• A @hidden tag on a constructor parameter-property will now only hide the property, not both the property and the parameter, #3111.
• Custom @group and @category titles with the same sort weight are now ordered consistently with the alphabetical reflection sort, #3120.

Thanks!

• @​greymoth-jp
• @​jonathanhefner
• @​kcastellino
• @​Metbcy
• @​StoneCypher
• @​wotan-allfather

Commits

• 34d843b Update changelog for release
• fbd4a25 Bump version to 0.28.20
• 93ba157 Update dependencies in example
• e8c5df8 Remove unnecessary files from distribution
• 392b0dd Update dependencies
• 8510dd4 Add missing entries in changelog before release
• 51dc052 Update change log for 0.28.20 release
• 72f20cd Merge branch 'fix-locale-sort-group-category-titles' into dev
• 623f2c0 Fix failing test, accept slightly slower build for now
• c8bdf14 Minor config tweak to improve dev build time
• Additional commits viewable in compare view

Updates vitest from 4.1.9 to 4.1.10

Release notes

Sourced from vitest's releases.

v4.1.10

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in vitest-dev/vitest#10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in vitest-dev/vitest#10661 (bae52)

    View changes on GitHub

Commits

• db616d2 chore: release v4.1.10 (#10718)
• bae52b5 fix(vm): fix external module resolve error with deps optimizer query for enco...
• See full diff in compare view

Description has been truncated

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​vitest/​ui@​4.1.10
	@​vitest/​browser@​4.1.10
	vitest@​4.1.10
	@​vitest/​coverage-v8@​4.1.10
	playwright@​1.61.1
	tsx@​4.23.1
	@​vitest/​coverage-istanbul@​4.1.10
	globals@​17.7.0
	smol-toml@​1.7.0
	@​vitest/​browser-playwright@​4.1.10
	typedoc@​0.28.20
	bignumber.js@​11.1.5
	axios@​1.18.1
	msw@​2.15.0
	rollup@​4.62.2

View full report

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates a few JavaScript dependencies to newer patch/minor versions.

Changes:

• Bump @vitest/coverage-istanbul from 4.1.9 to 4.1.10
• Bump esbuild from ^0.27.7 to ^0.28.1
• Bump axios from 1.18.0 to 1.18.1

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert  (click "▶" to expand/collapse)
Warn		Obfuscated code: npm yargs is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: pnpm-lock.yaml → npm/msw@2.15.0 → npm/yargs@17.7.3 ℹ Read more on: This package | This alert | What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/yargs@17.7.3. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.