[dependabot]

Bumps the minor-and-patch group with 42 updates in the / directory:

Package	From	To
module-alias	2.3.4	2.3.5
@axe-core/playwright	4.13.0	4.14.0
@biomejs/biome	2.5.15	2.6.6
@playwright/test	1.64.1	1.65.0
@types/node	26.6.5	26.6.6
axe-core	4.13.0	4.14.0
bun-types	1.4.3	1.4.4
knip	6.42.0	6.44.2
express-rate-limit	8.7.1	8.7.3
mongodb	7.7.0	7.8.0
stripe	23.0.1	23.1.0
supertokens-node	24.0.3	24.1.0
tslib	2.8.1	2.9.1
@types/lodash	4.17.26	4.17.27
bson	7.2.0	7.3.4
qs	6.16.1	6.17.1
supertest	7.3.1	7.3.2
@opentelemetry/exporter-logs-otlp-http	0.223.0	0.301.0
posthog-node	5.56.2	5.63.1
fast-xml-parser	5.11.2	5.12.0
jose	6.2.12	6.2.16
@tanstack/react-hotkeys	0.15.0	0.22.3
@tanstack/react-query	5.104.4	5.107.1
@tanstack/react-router	1.170.45	1.170.46
posthog-js	1.438.12	1.447.3
@stripe/react-stripe-js	7.0.0	7.0.1
@stripe/stripe-js	10.1.0	10.2.1
@tiptap/core	3.32.0	3.33.0
@tiptap/extension-link	3.32.0	3.33.0
@tiptap/extension-placeholder	3.32.0	3.33.0
@tiptap/pm	3.32.0	3.33.0
@tiptap/react	3.32.0	3.33.0
@tiptap/starter-kit	3.32.0	3.33.0
dexie	4.4.6	4.4.7
react-toastify	11.1.0	11.2.0
supertokens-website	20.1.6	20.1.8
zustand	5.0.15	5.1.0
@tailwindcss/postcss	4.3.3	4.3.5
@tanstack/react-query-devtools	5.104.4	5.107.1
fake-indexeddb	6.2.6	6.2.8
postcss	8.5.31	8.5.32
tailwindcss	4.3.3	4.3.5

Updates module-alias from 2.3.4 to 2.3.5

Commits

• See full diff in compare view

Updates @axe-core/playwright from 4.13.0 to 4.14.0

Release notes

Sourced from @​axe-core/playwright's releases.

Release 4.14.0

What's Changed

• docs(webdriverjs): update chrome options in example by @​G-Rath in dequelabs/axe-core-npm#1401
• chore: merge master into develop by @​attest-team-ci in dequelabs/axe-core-npm#1417
• ci: create the release tag when publishing to production by @​Garbee in dequelabs/axe-core-npm#1418
• chore: bump brace-expansion by @​dependabot[bot] in dequelabs/axe-core-npm#1419
• chore: bump tar and lerna by @​dependabot[bot] in dequelabs/axe-core-npm#1420
• chore: migrate from npm workspaces to pnpm by @​Garbee in dequelabs/axe-core-npm#1421
• chore(deps): upgrade dependencies and audit engine floors in CI by @​Garbee in dequelabs/axe-core-npm#1430
• chore: bump chromedriver from 152.0.0 to 152.0.1 in the browser-drivers group by @​dependabot[bot] in dequelabs/axe-core-npm#1435
• chore: bump the webdriverio group with 6 updates by @​dependabot[bot] in dequelabs/axe-core-npm#1434
• chore: bump eslint from 10.8.1 to 10.9.0 by @​dependabot[bot] in dequelabs/axe-core-npm#1437
• fix: exempt axe-core from the pnpm release-age cooldown by @​Garbee in dequelabs/axe-core-npm#1441
• feat: Update axe-core to v4.14.0 by @​attest-team-ci in dequelabs/axe-core-npm#1456
• chore: bump postcss-selector-parser from 7.1.5 to 7.1.6 by @​dependabot[bot] in dequelabs/axe-core-npm#1457
• chore: bump puppeteer from 25.8.0 to 25.12.0 in the puppeteer group by @​dependabot[bot] in dequelabs/axe-core-npm#1451
• chore: bump proxy-addr from 2.0.7 to 2.0.8 by @​dependabot[bot] in dequelabs/axe-core-npm#1458
• chore: bump nx from 23.1.1 to 23.2.1 by @​dependabot[bot] in dequelabs/axe-core-npm#1459
• chore: bump adm-zip from 0.6.0 to 0.6.1 by @​dependabot[bot] in dequelabs/axe-core-npm#1443
• chore: bump the webdriverio group across 1 directory with 7 updates by @​dependabot[bot] in dequelabs/axe-core-npm#1449
• ci: provide pnpm via action-setup in release workflows by @​Garbee in dequelabs/axe-core-npm#1461
• chore: RC v4.14.0 by @​attest-team-ci in dequelabs/axe-core-npm#1463
• fix(cli): restore bin paths and lint published package tarballs (#1467) by @​Garbee in dequelabs/axe-core-npm#1468
• chore: release v4.14.0 by @​axe-core in dequelabs/axe-core-npm#1479

New Contributors

• @​G-Rath made their first contribution in dequelabs/axe-core-npm#1401

Full Changelog: dequelabs/axe-core-npm@v4.13.0...v4.14.0

Changelog

Sourced from @​axe-core/playwright's changelog.

4.14.0 (2026-10-06)

Bug Fixes

• exempt axe-core from the pnpm release-age cooldown (#1441) (0bcb185), closes #1346 #1346 #1442 #1346

Features

• Update axe-core to v4.14.0 (#1456) (dccfe7a)

Commits

• 2375f7f chore: release v4.14.0 (#1479)
• d1531a9 fix(cli): restore bin paths and lint published package tarballs (#1467) (#1468)
• 8b31968 fix(cli): restore bin paths and lint published package tarballs (#1467)
• 556d23c chore: RC v4.14.0 (#1463)
• 74c9144 chore: RC v4.14.0
• 5617347 ci: provide pnpm via action-setup in release workflows (#1461)
• 6da92cb chore: bump the webdriverio group across 1 directory with 7 updates (#1449)
• 36e019f chore: bump adm-zip from 0.6.0 to 0.6.1 (#1443)
• e820472 chore: bump nx from 23.1.1 to 23.2.1 (#1459)
• 4fe97e0 chore: bump proxy-addr from 2.0.7 to 2.0.8 (#1458)
• Additional commits viewable in compare view

Updates @biomejs/biome from 2.5.15 to 2.6.6

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.6

2.6.6

Patch Changes

• #12887 da0422e Thanks @​dyc3! - Added the new nursery rule noArrayMethodsOnArguments. It reports calls to array methods on the arguments object, which isn't an array, so these calls throw a TypeError when the code runs.

  function sum() {
    return arguments.reduce((total, value) => total + value, 0);
  }

• #12877 cd9e10f Thanks @​dyc3! - Added the nursery rule noConstantComparisons, which reports && and || conditions that can never be true, are always true, or contain a check with no effect.

  if (statusCode <= 400 && statusCode > 500) {}

• #12876 a7c9586 Thanks @​dyc3! - Added the nursery rule noErasingOperation, which disallows operations with 0 that always result in zero: multiplying by 0, a bitwise AND with 0, and dividing 0 by a number. The other value in these operations has no effect on the result, which usually means the code has a mistake.

  const total = price * 0;

• #12841 e954f55 Thanks @​dyc3! - Added the nursery rule noNegatedArrayPredicate, which reports negated calls to Array#some() and Array#every() and suggests moving the negation into the callback function.

  // Invalid: use `array.every((item) => !isUnicorn(item))` instead.
  const isMissing = !array.some((item) => isUnicorn(item));

• #12888 15039f7 Thanks @​dyc3! - Added the new nursery rule noNumberArgumentOutOfRange, which reports number literal arguments of toString(), toFixed(), toExponential() and toPrecision() that are outside the range the method accepts. These calls throw a RangeError at runtime.

  value.toString(64);

• #12889 1cd7520 Thanks @​dyc3! - Added the nursery rule noSharedBranchCode, which reports code that is repeated at the start or end of every branch of an if statement. That code runs no matter which branch is taken, so it can be moved before or after the if statement.

  if (condition) {
    doSomething();
    cleanup();
  } else {
    doSomethingElse();
    cleanup();
  }

... (truncated)

Commits

• 09ee04d ci: release (#12938)
• 191111d feat(lint): add usePackageJsonEngines (#12310)
• 0538e30 feat(lint): add usePackageJsonCpu (#12309)
• 6b73fcf feat(lint): add noUninvokedArrayCallback (#12890)
• 1cd7520 feat(lint): add noSharedBranchCode (#12889)
• 15039f7 feat(lint): add noNumberArgumentOutOfRange (#12888)
• da0422e feat(lint): add noArrayMethodsOnArguments (#12887)
• 3bb18d8 feat(lint): add useNextScriptForGoogleAnalytics (#12886)
• cd9e10f feat(lint): add noConstantComparisons (#12877)
• a7c9586 feat(lint): add noErasingOperation (#12876)
• Additional commits viewable in compare view

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

... (truncated)

Commits

• a1f35e1 chore: mark v1.65.0 (#43925)
• a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
• 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
• daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
• 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
• 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
• 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
• d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
• 6e3f5ff docs: release notes for v1.65 (#43874)
• aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
• Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates axe-core from 4.13.0 to 4.14.0

Release notes

Sourced from axe-core's releases.

Release 4.14.0

This release enables a new rule, and introduces new violations in some existing rules. These can cause the issue totals to go up from a previous version. Similarly we've included various bug fixes to false positives which may see the issue count go down as well. This release focused on various performance improvements which should speed runs up 20% - 40% on most pages. On especially large pages we've measured a 15x performance improvement.

Features

• add EN 301 549 v4 tags to target-size (#5361) (8200d2b), closes #5311
• i18n: add Azerbaijani locale (#5385) (02e5fd4)
• label-content-name-mismatch: Enable rule by default (#5421) (c0d6163), references #5227

Bug Fixes

• aria-allowed-attr: report case-sensitive aria attributes with non-lowercase values (#5418) (1e33c6c), closes #5280, references #5224
• aria-hidden-focus: suggest removing aria-hidden in the fail messages (#5397) (aa4a0a1), references #4552 #5357 #4552
• aria-prohibited-attr: quote the element name in no-role messages (#5391) (24736a4), references #3730 #5357 #3730
• aria-required-children: allow caption in table, grid and treegrid (#5412) (ed987a2), references #5265
• aria-required-children: explain presentational children that cannot be ignored (#5407) (35a38d8), references #4833 #5357 #4833
• avoid-inline-spacing: test the text that gets the spacing from the element (#5411) (96e3e06), references #4232 #4232
• checks: add incomplete messages to checks that can return undefined (#5388) (6f1a6fe), references #5375 #5375
• checks: make listitem failure messages actionable (#5357) (6dd1be2)
• color-contrast: handle "none" and exponents in color strings (#5422) (cf5ed89), references #5313 #4136 #4007 #4269
• color-contrast: treat empty low-contrast text inputs as incomplete (#5359) (47029de), closes #4260, references #2130 #2130
• commons/dom: treat dialog as non-modal when elementsFromPoint is unsupported (#5202) (757b44a), references #4997
• commons/text/visibleVirtual: sanitize visible text once, not at every level (#5368) (2d47182), closes #5207, references #5207 act-rules/act-rules.github.io#2443
• core: use the fallback message when a check has no incomplete message (#5367) (4887c3a), closes #5344, references #5355
• label-content-name-mismatch: add support for cjk word splitting (#5437) (d53cb0a)
• label-content-name-mismatch: compare visible label to name by word (#5345) (4e3fcf5), references #5203 act-rules/act-rules.github.io#2443 #5207 #5308 #5203 #5346 #5207 #5207 #5302 #4311 #5203 #5302 #5302 #5344 #5203
• label-content-name-mismatch: ignore parenthesised content (#5360) (388132d), references act-rules/act-rules.github.io#2443 #5308 #5207 #5207 #5207
• label-content-name-mismatch: mark value-text roles incomplete (#5355) (5258f44), closes #4561, references #4561 #5344 #5345
• label-content-name-mismatch: normalize CJK and full-width text before comparing (#5419) (52dd387), references #5420 #5340 #5345 #5400 #5355 #5308 #5400
• no-focusable-content: say how to fix in the default fail message (#5392) (b84b76b), references #3267 #5357 #3194 #5357 #3267
• p-as-heading: ignore paragraphs with heading roles (#5348) (cbc33b9), references #5283
• process-message: separate array values with a comma and a space (#5393) (6ba9ee4), references #3344 #3344
• reporter: make addReporter isDefault set the default reporter (#5395) (eb854ed), references #4058 #4058
• scrollable-region-focusable: negative tabindex content needs review instead of failing outright (#5364) (72e8624)
• target-size: ignore overlapping links with the same destination (#5428) (2ba0812), references #5406 #4224
• Update de.json (#5353) (4d306cb)
• utils: resolve @​import url against the stylesheet that contains it (#5269) (e618fb6), closes #5268

Changelog

Sourced from axe-core's changelog.

4.14.0 (2026-10-05)

Features

• add EN 301 549 v4 tags to target-size (#5361) (8200d2b), closes #5311
• i18n: add Azerbaijani locale (#5385) (02e5fd4)
• label-content-name-mismatch: Enable rule by default (#5421) (c0d6163), references #5227

Bug Fixes

• aria-allowed-attr: report case-sensitive aria attributes with non-lowercase values (#5418) (1e33c6c), closes #5280, references #5224
• aria-hidden-focus: suggest removing aria-hidden in the fail messages (#5397) (aa4a0a1), references #4552 #5357 #4552
• aria-prohibited-attr: quote the element name in no-role messages (#5391) (24736a4), references #3730 #5357 #3730
• aria-required-children: allow caption in table, grid and treegrid (#5412) (ed987a2), references #5265
• aria-required-children: explain presentational children that cannot be ignored (#5407) (35a38d8), references #4833 #5357 #4833
• avoid-inline-spacing: test the text that gets the spacing from the element (#5411) (96e3e06), references #4232 #4232
• checks: add incomplete messages to checks that can return undefined (#5388) (6f1a6fe), references #5375 #5375
• checks: make listitem failure messages actionable (#5357) (6dd1be2)
• color-contrast: handle "none" and exponents in color strings (#5422) (cf5ed89), references #5313 #4136 #4007 #4269
• color-contrast: treat empty low-contrast text inputs as incomplete (#5359) (47029de), closes #4260, references #2130 #2130
• commons/dom: treat dialog as non-modal when elementsFromPoint is unsupported (#5202) (757b44a), references #4997
• commons/text/visibleVirtual: sanitize visible text once, not at every level (#5368) (2d47182), closes #5207, references #5207 act-rules/act-rules.github.io#2443
• core: use the fallback message when a check has no incomplete message (#5367) (4887c3a), closes #5344, references #5355
• label-content-name-mismatch: add support for cjk word splitting (#5437) (d53cb0a)
• label-content-name-mismatch: compare visible label to name by word (#5345) (4e3fcf5), references #5203 act-rules/act-rules.github.io#2443 #5207 #5308 #5203 #5346 #5207 #5207 #5302 #4311 #5203 #5302 #5302 #5344 #5203
• label-content-name-mismatch: ignore parenthesised content (#5360) (388132d), references act-rules/act-rules.github.io#2443 #5308 #5207 #5207 #5207
• label-content-name-mismatch: mark value-text roles incomplete (#5355) (5258f44), closes #4561, references #4561 #5344 #5345
• label-content-name-mismatch: normalize CJK and full-width text before comparing (#5419) (52dd387), references #5420 #5340 #5345 #5400 #5355 #5308 #5400
• no-focusable-content: say how to fix in the default fail message (#5392) (b84b76b), references #3267 #5357 #3194 #5357 #3267
• p-as-heading: ignore paragraphs with heading roles (#5348) (cbc33b9), references #5283
• process-message: separate array values with a comma and a space (#5393) (6ba9ee4), references #3344 #3344
• reporter: make addReporter isDefault set the default reporter (#5395) (eb854ed), references #4058 #4058
• scrollable-region-focusable: negative tabindex content needs review instead of failing outright (#5364) (72e8624)
• target-size: ignore overlapping links with the same destination (#5428) (2ba0812), references #5406 #4224
• Update de.json (#5353) (4d306cb)
• utils: resolve @​import url against the stylesheet that contains it (#5269) (e618fb6), closes #5268

Commits

• e797173 chore(release): v4.14.0 (#5438)
• 6976881 chore(release): 4.14.0
• d53cb0a fix(label-content-name-mismatch): add support for cjk word splitting (#5437)
• 35a38d8 fix(aria-required-children): explain presentational children that cannot be i...
• 2ba0812 fix(target-size): ignore overlapping links with the same destination (#5428)
• 1e33c6c fix(aria-allowed-attr): report case-sensitive aria attributes with non-lowerc...
• f59642e chore: bump mocha from 11.8.0 to 12.0.2 (#5426)
• 6efcb6e chore: bump emoji-regex from 10.6.0 to 11.0.0 (#5427)
• 2da49a3 chore: bump the npm-low-risk group across 1 directory with 7 updates (#5425)
• aa4a0a1 fix(aria-hidden-focus): suggest removing aria-hidden in the fail messages (#5...
• Additional commits viewable in compare view

Updates bun-types from 1.4.3 to 1.4.4

Release notes

Sourced from bun-types's releases.

Bun v1.4.4

To install Bun v1.4.4

curl -fsSL https://bun.com/install | bash
# or you can use npm
# npm install -g bun

Windows:

powershell -c "irm bun.com/install.ps1|iex"

To upgrade to Bun v1.4.4:

bun upgrade

Read Bun v1.4.4's release notes on Bun's blog

Thanks to 39 contributors!

• @​0xh3x
• @​1cedsoda
• @​alex-mextner
• @​alii
• @​Artoria2e5
• @​bompus
• @​C0casio45
• @​cirospaciari
• @​davidhevn
• @​deepshekhardas
• @​Dex4Sure
• @​dylan-conway
• @​EffortlessSteven
• @​eriklangille
• @​filipesarturi
• @​fredluz
• @​gerardp
• @​gohryt
• @​himself65
• @​hughescr
• @​Jarred-Sumner
• @​jdjkelly
• @​jecquas
• @​jobansd
• @​kernoeb
• @​KilianB
• @​MarshallOfSound
• @​Neekoras

... (truncated)

Commits

• a950fc5 Hardening follow-up: fix regressions from #46021 and more crashes (#46270)
• 9b4284f Hardening: fix crashes across the runtime, bundler, dev server, shell and CLI...
• 3880151 Move Crypto, TextDecoder, Bun.FileSystemRouter and three more classes t...
• 5667cd6 sql: fixes for problems found after the consolidation (#45304) (#45711)
• d0831bc Check published types against the bindgen schemas, honor memLevel and `stra...

[github-actions]

Boot bundle: 594.5 KB gzip (+0.0 KB vs main)