chore(deps-dev): bump the dev-tooling group across 1 directory with 4 updates

[dependabot]

Bumps the dev-tooling group with 4 updates in the /web directory: @vitest/coverage-v8, jsdom, vitest and wrangler.

Updates @vitest/coverage-v8 from 5.0.2 to 5.0.3

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.3

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in vitest-dev/vitest#11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in vitest-dev/vitest#11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in vitest-dev/vitest#11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in vitest-dev/vitest#11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in vitest-dev/vitest#11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in vitest-dev/vitest#11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in vitest-dev/vitest#11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in vitest-dev/vitest#11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in vitest-dev/vitest#11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in vitest-dev/vitest#11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

Commits

• 33cadea chore: release v5.0.3 (#11409)
• a029e76 chore: migrate to oxc (#11367)
• See full diff in compare view

Updates jsdom from 30.1.1 to 30.1.2

Release notes

Sourced from jsdom's releases.

v30.1.2

• Updated URLs to support Unicode v18.0.0 in internationalized domain names.
• Reduced package size and memory use for CSS property definitions. (@​scttcper)
• Fixed severe slowdowns when building large DOM trees, including SVG charts with D3, which regressed in v30.1.0. (@​cmdcolin)
• Fixed exponentially slow reads of empty inherited CSS custom properties in deeply nested documents, and custom properties incorrectly inheriting past an initial reset. (@​scttcper)
• Fixed getComputedStyle() returning stale results after editing stylesheet declarations, selectors, or media queries, including in imported stylesheets.
• Fixed selector matching and computed styles after changes to form control checkedness, indeterminacy, selection, values, and validity, including during form resets and canceled clicks.
• Fixed computed styles for :focus, :focus-visible, :focus-within, and selectors containing them after focus changes, including inside focus and blur listeners. (@​asamuzaK)
• Fixed element.focus() incorrectly focusing elements hidden by 'display', including through shadow hosts and slots, and elements excluded by shadow DOM slot assignment. (@​asamuzaK)
• Fixed getComputedStyle() throwing for elements without inline-style support, including XML and MathML elements.
• Fixed a memory leak where stylesheet parsing retained the last parsed stylesheet's window after window.close().
• Fixed memory growth from long-lived MutationObserver instances retaining bookkeeping for garbage-collected nodes. (@​scttcper)
• Fixed retained select.selectedOptions collections becoming stale after selection changes and form resets.
• Fixed rejection of negative CSS sizing values, including for 'min-width', 'min-height', 'max-width', and 'max-height', which regressed in v30.1.0.
• Fixed handling of deeply nested color-mix() expressions, including exceptions during color resolution. (@​asamuzaK)

Commits

• a23bfb7 30.1.2
• 64a75d2 Update dependencies and dev dependencies
• 7bf9653 Invalidate styles after CSSOM and control state changes
• fe9009c Update focused area handling
• a8d28b3 Release windows retained by stylesheet parsing
• 05a2c01 Deduplicate generated CSS property metadata
• 1efa190 Reduce generated CSS property data
• a372e12 Avoid Document named-property rebuilds after irrelevant tree mutations
• b2cd235 Update css-color
• 0542d2b Release idle MutationObserver bookkeeping
• Additional commits viewable in compare view

Updates vitest from 5.0.2 to 5.0.3

Release notes

Sourced from vitest's releases.

v5.0.3

   🐞 Bug Fixes

• Isolate result.status between repeats runs  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11218 (5dbeb)
• Don't print an interceptor warning in browser mode  -  by @​sheremet-va in vitest-dev/vitest#11377 (15cc0)
• Don't retry when test.fails expectedly failed  -  by @​hi-ogawa, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11219 (b2458)
• Scope cache key generators to projects  -  by @​ecoyoung in vitest-dev/vitest#11281 and vitest-dev/vitest#11301 (92ba7)
• browser:
  • Delay server listen until tests start running  -  by @​sheremet-va in vitest-dev/vitest#11366 (7d8ed)
  • Check mock path boundaries  -  by @​saryn17, Ryosei Sato and @​sheremet-va in vitest-dev/vitest#11361 and vitest-dev/vitest#11362 (1c388)
  • Keep config of browser-consumed environments  -  by @​kasperpeulen and Claude in vitest-dev/vitest#11378 (aafc0)
  • Ignore page crash while cancelling  -  by @​sheremet-va in vitest-dev/vitest#11386 (7c367)
  • toMatchScreenshot uses wrong reference on retried tests  -  by @​macarie in vitest-dev/vitest#11393 (c22ab)
• cache:
  • Revalidate imports of cached modules  -  by @​sheremet-va in vitest-dev/vitest#11381 (38f98)
• deps:
  • Pin why-is-node-running to 3.2.1 to avoid users running into ERR_PNPM_TRUST_DOWNGRADE  -  by @​AriPerkkio in vitest-dev/vitest#11403 (f6c9a)
• expect:
  • Pass current equality testers to expect.extend asymmetric matchers  -  by @​hi-ogawa, Hiroshi Ogawa and Claude in vitest-dev/vitest#11401 (3e794)
• jsdom:
  • Support Blob on jsdom 30.1  -  by @​sheremet-va in vitest-dev/vitest#11379 (6c49b)
• pool:
  • Preserve unique pool ids when groupOrder is set  -  by @​mtorp in vitest-dev/vitest#11392 (50312)
• ui:
  • Split-pane handle overlapping iframe  -  by @​macarie in vitest-dev/vitest#11221 (f91db)
• vitest:
  • Remove root temp dir on close  -  by @​abhinav-phi in vitest-dev/vitest#11248 (7c711)
• vm:
  • Do not optimize deps from index.html  -  by @​ezefernandezyf, Hiroshi Ogawa and Codex (GPT-6) in vitest-dev/vitest#11329 and vitest-dev/vitest#11360 (caf28)
  • Don't reuse scripts across vite environments  -  by @​MO2k4, Martin Oehlert and Claude in vitest-dev/vitest#11395 (346d3)

    View changes on GitHub

Commits

• 33cadea chore: release v5.0.3 (#11409)
• 346d389 fix(vm): don't reuse scripts across vite environments (#11395)
• f6c9a49 fix(deps): pin why-is-node-running to 3.2.1 to avoid users running into `...
• 062c75d chore: fix standalone docs build, update exports maps (#11394)
• caf2887 fix(vm): do not optimize deps from index.html (fix #11329) (#11360)
• 50312eb fix(pool): preserve unique pool ids when groupOrder is set (#11392)
• 7c36748 fix(browser): ignore page crash while cancelling (#11386)
• 92ba7fc fix: scope cache key generators to projects (fix #11281) (#11301)
• 38f9885 fix(cache): revalidate imports of cached modules (#11381)
• b24585f fix: don't retry when test.fails expectedly failed (#11219)
• Additional commits viewable in compare view

Updates wrangler from 4.142.0 to 4.149.0

Release notes

Sourced from wrangler's releases.

wrangler@4.149.0

Minor Changes

• #16036 9a58244 Thanks @​edevil! - Support temporary event accounts in R2 and Containers commands

  wrangler r2 and wrangler containers commands now accept the hidden --temporary flag, so accounts created for an event can manage buckets, objects and containers directly. Every command that supports --temporary now also accepts a hidden --event-code flag, so the first command a participant runs can create the event account:

  wrangler r2 bucket create my-bucket --temporary --event-code <code>

  R2 and Containers are only available on event accounts. R2 custom domains, Sippy, external container registries and wrangler cloudchamber commands still require a logged-in account.

Patch Changes

• #16139 2d1d563 Thanks @​cpojer! - Update esbuild to 0.28.2

  Align esbuild dependency with tooling using the latest 0.28 patch so package managers can share one installation instead of downloading a second native binary.

• #15632 85b14e7 Thanks @​petebacondarwin! - Honor Retry-After directives during static asset uploads

  Static asset uploads now pause retries and pending uploads until the latest outstanding deadline requested by the API. A per-request limiter also keeps gateway retries at the reduced concurrency after the pause ends, preventing a deployment from immediately overloading a constrained asset service again.

• #16098 fe607f9 Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  sharp	0.35.4	0.35.5

• #16093 ad7ff45 Thanks @​DiogoSantoss! - Document that addresses catch-all entries must use the zone apex

  A *@domain entry in addresses must use the zone apex, such as *@example.com. The zone catch-all also receives mail for every subdomain in the zone that has no literal rule.

• #16102 757faa6 Thanks @​tlq5l! - Keep Preview secrets when deploying to an existing Preview

  Secrets added to a Preview with wrangler preview secret put or wrangler preview secret bulk were lost the next time wrangler preview ran, because each new deployment was created from the Wrangler config, --var and --secrets-file values only.

  wrangler preview now carries over the secrets of the Preview's latest deployment. A value passed in this deployment (--secrets-file, --var or a previews binding with the same name) still replaces the existing secret, and wrangler preview secret delete removes one.

• #15617 93c1069 Thanks @​jpatel3! - Stop the update check from recommending deprecated versions

  Previously, the "update available" notice shown by wrangler and @cloudflare/vite-plugin always pointed at whichever version was tagged latest on npm, even after that version had been deprecated for shipping a bug. Deprecated versions are now never recommended: if the latest release has been deprecated, the newest non-deprecated stable release below it is suggested instead, or nothing at all if you are already on it.

  The check now reads the npm registry directly instead of going through the update-check package, which discarded the deprecation information. The on-disk cache location and one-hour refresh interval are unchanged.

• #16003 6947df3 Thanks @​oddharsh! - Ship using and await using declarations to the runtime as written, for smaller Worker bundles

  Workers and Pages Functions that use explicit resource management no longer carry about 1 KB of bundled helper code to emulate it. workerd supports using and await using natively at every compatibility date, so wrangler deploy, wrangler versions upload and Pages Functions builds now leave these declarations untouched.

• #15958 82acf3c Thanks @​breken-ai! - Apply each action's own condition in wrangler r2 bucket lifecycle add

... (truncated)

Commits

• 84c4e95 Version Packages (#16099)
• 82acf3c [wrangler] Apply each action's own condition in r2 bucket lifecycle add (#1...
• 757faa6 [wrangler] Keep Preview secrets when deploying to an existing Preview (#16102)
• 85b14e7 [deploy-helpers] respect Retry-After during asset uploads (#15632)
• 6947df3 [wrangler][vite-plugin] Preserve using declarations when bundling (#16003)
• 9a58244 [wrangler] Support temporary event accounts in R2 and Containers commands (#1...
• 540f084 Version Packages (#16034)
• 42c7219 [wrangler] Fix r2 object put and r2 bulk put storing a different key in local...
• 2dde890 [wrangler] Clarify secret version errors and support versions bulk deletions ...
• b4e1299 [wrangler] Add --source-namespace and --source-repo-name for artifacts.repo q...
• Additional commits viewable in compare view

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​vitest/​coverage-v8@​5.0.3
	npm/​vitest@​5.0.3
	npm/​wrangler@​4.142.0 ⏵ 4.149.0
	npm/​jsdom@​30.1.2

View full report

[rainmanjam]

Included in #895 (batched October Dependabot updates), now merged.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml