Skip to content

chore(deps): bump the npm-deps group with 6 updates - #95

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-715e69a394
Open

chore(deps): bump the npm-deps group with 6 updates#95
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-deps-715e69a394

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 15, 2026

Copy link
Copy Markdown
Contributor

Bumps the npm-deps group with 6 updates:

Package From To
@hono/node-server 2.1.3 2.1.4
hono 4.13.12 4.13.13
pino 10.3.1 10.4.0
@playwright/test 1.63.0 1.64.0
eslint 10.11.0 10.12.0
fallow 3.31.0 3.32.0

Updates @hono/node-server from 2.1.3 to 2.1.4

Release notes

Sourced from @​hono/node-server's releases.

v2.1.4

What's Changed

Full Changelog: honojs/node-server@v2.1.3...v2.1.4

Commits

Updates hono from 4.13.12 to 4.13.13

Release notes

Sourced from hono's releases.

v4.13.13

Mount Middleware

app.mount() is now available as the Mount Middleware, hono/mount. It is just a handler, so you register it with app.all():

import { Router as IttyRouter } from 'itty-router'
import { Hono } from 'hono'
import { mount } from 'hono/mount'
const ittyRouter = IttyRouter()
ittyRouter.get('/hello', () => new Response('Hello from itty-router'))
const app = new Hono()
app.all('/itty-router/*', mount(ittyRouter.handle))

app.mount() still works in v4 but is deprecated and will be removed in v5. Migrating is a one-line change:

- app.mount('/itty-router', ittyRouter.handle)
+ app.all('/itty-router/*', mount(ittyRouter.handle))

What's Changed

  • test(client): simulate network error for undefined route in parseResponse test in honojs/hono#5439
  • docs(request): fix jsdoc comments for some getters in honojs/hono#5445
  • fix(jsx): allow JSXNode function component results in honojs/hono#5476
  • feat(mount): introduce Mount Middleware and deprecate app.mount in honojs/hono#5221

Full Changelog: honojs/hono@v4.13.12...v4.13.13

Commits
  • 08a023c 4.13.13
  • ae595de feat(mount): introduce Mount Middleware and deprecate app.mount (#5221)
  • f23b146 fix(jsx): allow JSXNode function component results (#5476)
  • 6d73a74 docs(request): fix jsdoc comments for some getters (#5445)
  • deff529 test(client): simulate network error for undefined route in parseResponse tes...
  • See full diff in compare view

Updates pino from 10.3.1 to 10.4.0

Release notes

Sourced from pino's releases.

v10.4.0

What's Changed

... (truncated)

Commits
  • b29dbe9 Bumped v10.4.0
  • 6ba157b docs: fix the pino-pretty flush explanation after thread-stream#198 (#2524)
  • 6429c14 docs: Note that serializers run on child bindings at creation time (#2518)
  • 6c71bc9 Add bindings method to browser logger (#2504)
  • b557f72 ci: pin lock-threads to upstream v6.0.2 to fix token validation failure (#2525)
  • 1de1212 docs: document the APIs that are unavailable in the browser (#2521)
  • af2fe10 Delete .github/dependabot.yml (#2517)
  • 5aa6230 build(deps-dev): bump eslint-plugin-n from 18.2.2 to 18.3.0 (#2515)
  • 6f5af07 build(deps-dev): bump docsify-cli from 4.4.4 to 5.0.0 (#2513)
  • 2ffe576 ci: check pull requests target main (#2500)
  • Additional commits viewable in compare view

Updates @playwright/test from 1.63.0 to 1.64.0

Release notes

Sourced from @​playwright/test's releases.

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
highlight: 'outline: 2px solid #333; background: rgba(0, 128, 255, .15)',
title: 'font-size: 16px',
},
},
},
},
</tr></table>

... (truncated)

Commits
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • a0c4b5e cherry-pick(#43175): feat(api): return language-specific locator code from re...
  • 3f7d535 cherry-pick(#43131): docs: fix broken C# samples in API docs and handles guide
  • 1cde64f cherry-pick(#43170): fix(locators): parse mixed role options
  • 8851e72 cherry-pick(#43171): fix(locators): parse JavaScript escapes and regex classes
  • dcc5065 cherry-pick(#43172): fix(locator): parse within and getByRef locators
  • Additional commits viewable in compare view

Updates eslint from 10.11.0 to 10.12.0

Release notes

Sourced from eslint's releases.

v10.12.0

Features

  • 4618052 feat: handle astral letters in new-cap (#21357) (sary)
  • 4ec5168 feat: allow SourceCode#getText() to accept tokens and comments (#21340) (electrohyun)

Bug Fixes

  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373) (Daniel Pinto)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332) (xbinaryx)
  • efc4d6b fix: astral letters in consistent-return, no-eval, no-invalid-this (#21360) (lumir)
  • 93de066 fix: prefer-exponentiation-operator autofix for async function base (#21322) (Vladimir Babin)
  • 02e34ff fix: add missing space after else in curly autofix (#21355) (Pixel)
  • b14b8bc fix: correct id-length message for long private names (#21348) (Pixel)
  • 69aac01 fix: support TSFunctionType in getFunctionHeadLoc (#21335) (xbinaryx)
  • 686630e fix: no-loss-of-precision false positive with 0.e5 (#21337) (sethamus)

Documentation

  • 67eb586 docs: Update README (GitHub Actions Bot)
  • 5370d7e docs: clarify one-var separateRequires matches any require() call (#21192) (sethamus)
  • 8816c1d docs: Update README (GitHub Actions Bot)
  • 3d2e7ce docs: fix typo in no-unused-expressions documentation (#21346) (bytedoe)

Chores

  • 152067f chore: update ecosystem plugins (#21362) (ESLint Bot)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#21376) (renovate[bot])
  • bfaea12 perf: cache normalized config globals per languageOptions (#21364) (James Ross)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369) (Francesco Trotta)
  • d166567 chore: update dependency prettier to v3.9.9 (#21371) (renovate[bot])
  • 29585ce chore: update dependency eslint-plugin-expect-type to ^0.7.0 (#21359) (renovate[bot])
  • 39d79ba chore: update github/codeql-action action to v4.38.1 (#21354) (renovate[bot])
  • 182a6e9 chore: update dependency prettier to v3.9.8 (#21352) (renovate[bot])
  • f995127 chore: remove CLAUDE.md in favor of AGENTS.md (#21339) (Jarren)
  • b95fb6c chore: update dependency prettier to v3.9.7 (#21347) (renovate[bot])
  • 3782dd4 chore: update ecosystem plugins (#21342) (ESLint Bot)
Commits
  • a438ec3 10.12.0
  • 32a73f1 Build: changelog update for 10.12.0
  • bc51eee fix: prefer-arrow-callback false positive in conditional test (#21373)
  • bbff86c fix: skip lines with multiple comments in max-lines-per-function (#21332)
  • 152067f chore: update ecosystem plugins (#21362)
  • b56d58e chore: update github/codeql-action action to v4.38.2 (#21376)
  • 67eb586 docs: Update README
  • bfaea12 perf: cache normalized config globals per languageOptions (#21364)
  • 322209e ci: avoid Nx cache in ecosystem tests and disable failing test (#21369)
  • d166567 chore: update dependency prettier to v3.9.9 (#21371)
  • Additional commits viewable in compare view

Updates fallow from 3.31.0 to 3.32.0

Release notes

Sourced from fallow's releases.

v3.32.0: grouped health trends, markdown from saved runs, dead-code accuracy fixes

Features

  • fallow dead-code --absent-component-props reports optional props that callers never pass. The rule reports an optional component prop that no known reachable caller passes. It is off by default. It supports React, Preact, Solid, Qwik, Vue, Svelte, Astro, Angular, Lit and Ember components. Each finding shows the declaration, the callers, the framework and whether a default exists. Fallow gives no finding when it cannot see every caller of the component. Static analysis does not prove that a prop is unreachable at runtime. Review defaults and API intent manually. The rule has no automatic fix.
  • fallow health --group-by selects groups and tracks a trend per group. --group <KEY> keeps only the matching groups. It accepts exact keys, globs and ! negations. Each group gets severity and hotspot counts. --save-snapshot on a grouped run stores the group data (snapshot schema v11). --trend or the new --trend-from <PATH> then adds a trend per group. Markdown and the GitHub job summary get a ## Health by <mode> table and one findings block per group. --top N now applies to each group. The MCP check_health tool accepts group and trend_from.
  • fallow report --from <file> --format markdown renders saved JSON output. A saved dead-code, dupes, health or bare combined run gives the same markdown as the live run with the same flags. You can analyze once and write both a job summary and a markdown report from one JSON file. The saved output of a combined run does not record --group-by, so its markdown is not grouped. A saved audit, security or fix run, and a combined run with type-aware evidence, exit 2 with a reason.
  • fallow dupes marks symlinked clone instances. A clone instance under a symlink now has is_symlink: true in JSON, symlink=true in compact output and a (symlink) marker in human output. To report only duplication between real files, set duplicates.ignoreSymlinks: true or pass --ignore-symlinks. --no-ignore-symlinks overrides the config value. The MCP tools, the Node API, the LSP and the VS Code setting fallow.duplication.ignoreSymlinks accept the same option. Thanks @​lzear for the report (#2961).
  • fallow agent install adds a native commit gate for Codex. The install writes a PreToolUse handler to .codex/hooks.json and the gate script to .codex/hooks/fallow-gate.sh. The handler runs the audit from the nearest install root, also from a subdirectory. The Claude Code handler now also finds the nearest install root. Run fallow agent install again to get the new handler. Codex runs a hook only after you trust it in /hooks. fallow agent status shows the gate as its own row, and fallow hooks status --format json adds a codex_gate entry. The AGENTS.md block is now routing guidance. fallow hooks install --target agent --agent codex --user now writes the user gate and no longer writes the project AGENTS.md block.
  • The new fallow-setup skill tells an agent how to add code-quality tools. The skill is for a JavaScript or TypeScript project. It tells the agent to detect the existing tools, run fallow recommend, install Fallow as a dev dependency and add a CI gate with a baseline. It gives each tool one job, and it removes a tool only after a parity check. fallow agent install writes it next to the fallow skill.
  • The gdp-proof-producer rule-pack kind restricts proof producers. The opt-in rule restricts @gdp-ts/core.defineProof calls to allowedFiles. proofKinds assigns literal proof labels to owner modules. The analysis follows static imports and unambiguous re-export chains.
  • Fallow has new built-in plugins.
    • release-it keeps each .release-it.* config form and reads the package.json key. It does not read the JSON5, YAML and TOML forms. It credits the plugins and extends packages.
    • eve makes agent modules entry points.
    • ag-ui credits the hooks of a class that extends AbstractAgent directly.
    • nestjs-trpc credits the methods that the module calls.
    • kibana reads kibana.jsonc plugin manifests and adds their entry points.
  • The health JSON names the sections that the run produced. The root array sections lists each section that the run computed. With --baseline, summary.baseline_staleness.remaining_findings gives the number of functions above a threshold that the baseline does not accept.
  • The CLI, MCP and the LSP report the same finding_id for a security finding. The VS Code "Copy Fallow finding id" quick fix now works on a security candidate (#3035).
  • Fallow can suggest its Claude Code plugin. Inside a Claude Code session, Fallow writes one hint line to stderr for human output. Fallow writes the hint only without --quiet, outside CI, and when no Fallow plugin or skill is installed. The hint has no effect until the official marketplace lists the Fallow plugin. Set FALLOW_CLAUDE_CODE_HINT=off or FALLOW_SUGGESTIONS=off to suppress it.

Changed

  • Tooling dependencies need evidence of use. Three kinds of devDependency no longer count as used by name alone:

    • A command-line tool from the tooling catalogue.
    • A tooling package of an active plugin.
    • A @types/X package.

    A tool counts as used when a script, a CI workflow or a git hook runs it. It also counts when its config file or its package.json key exists, or when a plugin credits it. Fallow now reads git hooks in .husky/, lefthook, simple-git-hooks and lint-staged configs. A @types/X package counts as used when the project declares or imports X, or names X in tsconfig types. A short list of global type packages, such as @types/node, always counts. --trace-dependency names each credit. Production dependencies still count as used by name.

  • Root dependencies follow the nearest manifest. Each import now counts for the nearest manifest that installs the package. Fallow reports a root declaration as unused when each import uses a workspace declaration. The finding has a declared_and_imported_in field that names those workspaces. Such an entry gets one finding, not a second test-only or type-only finding.

  • export default Name links to the local binding Name. Fallow now reports unused members of a class that a file exports this way. With ignoreExportsUsedInFile, such a default export is used when the file uses Name.

  • fallow health --group-by counts a clone in each group that holds an instance. The group duplicated_lines values now sum to the project value. Group scores can drop once after the upgrade.

  • CODEOWNERS matching follows GitHub. A pattern without a trailing / owns the directory contents. * does not match /, apps/ matches an apps directory at any depth, and /* owns only the files at the root. Owner groups can change.

  • Gate rows show a count. The health-findings and error-severity-findings entries in gate_outcomes now have observed and threshold_label. The PR decision and the PR comment show the count, for example 6 at or above error.

  • fallow hooks install --target agent selects Codex from a .codex/ directory, not from AGENTS.md alone.

Bug fixes

Dependencies

  • Fallow no longer reports an optional peer of a used dependency as unused. Fallow also no longer reports a devDependency that the same manifest lists as a peer. An optional peer that the project does not list no longer credits its own peers.
  • A peer-only entry no longer hides the ancestor workspace that installs a package. A workspace file can use a package that an ancestor manifest declares. This does not apply to production code in a publishable workspace. An ancestor declaration counts as used when a nested workspace uses it.
  • A postcss.config.* file credits the PostCSS plugins that it names, also without a declared postcss package.
  • A script binary credits every package that can provide it, for example run-p for npm-run-all2.
  • Fallow credits a runtime loader that a tool config needs, such as ts-node for a TypeScript Jest config. The Mocha plugin reads .mocharc files and the mocha key.
  • A tool config file in a workspace package credits the root devDependency of that tool.
  • require.resolve and import.meta.resolve with any subpath credit the package. require.resolve('pkg') reports an unlisted package. Thanks @​DrJKL for the report (#3213).
  • import {} from 'pkg', a module augmentation declare module 'pkg', and a node_modules/.bin/<name> path in source credit the package.
  • Fallow credits Expo config plugins in the app config, Oxlint jsPlugins inside overrides, and packages in Starlight customCss.
  • React Router apps without entry.server no longer report isbot as unused.
  • An esbuild call in a test file no longer removes the credit that a dependent workspace gets for the packages of a private sibling. Fallow removes that credit only when a build file or a package script sets every package external.

... (truncated)

Commits
  • aaaec79 chore: release v3.32.0
  • f79576a fix(release): pin cargo-zigbuild 0.23.4 for the aarch64-musl build (#3272)
  • 47f17f3 chore: release v3.32.0
  • 3380750 chore(deps-dev): bump oxlint in /apps/review-electron (#3256)
  • 791aa13 chore(deps): bump rmcp from 3.4.1 to 3.5.0 (#3269)
  • d07accc chore(deps-dev): bump vitest from 5.0.1 to 5.0.2 in /viz-frontend (#3257)
  • 6ea600d chore(deps): bump github/codeql-action/upload-sarif (#3266)
  • d7f0d25 chore(deps-dev): bump @​types/d3-zoom in /viz-frontend (#3254)
  • 7c0ed57 chore(deps-dev): bump vitest in /apps/review-electron (#3259)
  • b0de2d9 chore(deps-dev): bump oxfmt in /apps/review-electron (#3265)
  • Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

@dependabot
chore(deps): bump the npm-deps group with 6 updates
b98dcca 
Bumps the npm-deps group with 6 updates:

| Package | From | To |
| --- | --- | --- |
| [@hono/node-server](https://github.com/honojs/node-server) | `2.1.3` | `2.1.4` |
| [hono](https://github.com/honojs/hono) | `4.13.12` | `4.13.13` |
| [pino](https://github.com/pinojs/pino) | `10.3.1` | `10.4.0` |
| [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.0` |
| [eslint](https://github.com/eslint/eslint) | `10.11.0` | `10.12.0` |
| [fallow](https://github.com/fallow-rs/fallow) | `3.31.0` | `3.32.0` |


Updates `@hono/node-server` from 2.1.3 to 2.1.4
- [Release notes](https://github.com/honojs/node-server/releases)
- [Commits](honojs/node-server@v2.1.3...v2.1.4)

Updates `hono` from 4.13.12 to 4.13.13
- [Release notes](https://github.com/honojs/hono/releases)
- [Commits](honojs/hono@v4.13.12...v4.13.13)

Updates `pino` from 10.3.1 to 10.4.0
- [Release notes](https://github.com/pinojs/pino/releases)
- [Commits](pinojs/pino@v10.3.1...v10.4.0)

Updates `@playwright/test` from 1.63.0 to 1.64.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.0)

Updates `eslint` from 10.11.0 to 10.12.0
- [Release notes](https://github.com/eslint/eslint/releases)
- [Commits](eslint/eslint@v10.11.0...v10.12.0)

Updates `fallow` from 3.31.0 to 3.32.0
- [Release notes](https://github.com/fallow-rs/fallow/releases)
- [Changelog](https://github.com/fallow-rs/fallow/blob/main/release.toml)
- [Commits](fallow-rs/fallow@v3.31.0...v3.32.0)

---
updated-dependencies:
- dependency-name: "@hono/node-server"
  dependency-version: 2.1.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: hono
  dependency-version: 4.13.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: npm-deps
- dependency-name: pino
  dependency-version: 10.4.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: "@playwright/test"
  dependency-version: 1.64.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: eslint
  dependency-version: 10.12.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
- dependency-name: fallow
  dependency-version: 3.32.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-deps
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 15, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants