[dependabot]

Bumps the dev-dependencies group with 10 updates:

Package	From	To
@biomejs/biome	2.5.12	2.6.4
@microsoft/tsdoc-config	0.18.1	0.18.3
@types/node	26.5.0	26.6.6
cspell	10.3.0	10.4.0
eslint	10.10.0	10.14.0
eslint-plugin-tsdoc	0.5.2	0.5.4
playwright	1.62.1	1.64.1
typescript-eslint	8.70.0	8.72.1
vite	8.2.4	8.3.5
vite-plugin-dts	5.0.3	5.1.2

Updates @biomejs/biome from 2.5.12 to 2.6.4

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.6.4

2.6.4

Patch Changes

• #12261 19fbfb2 Thanks @​dyc3! - Added the new nursery rule noConsoleSpaces, which reports a leading or trailing space in a console.log(), console.debug(), console.info(), console.warn(), or console.error() argument that sits next to another argument. These methods already put a space between arguments, so such a space prints twice.

  console.log("abc ", "def");

• #12469 cd716d3 Thanks @​dyc3! - Added the new nursery rule noMagicArrayFlatDepth, which reports number literals other than 1 passed as the depth of Array.prototype.flat() unless a comment inside the parentheses explains them.

  const items = array.flat(2);

• #12470 92c9e81 Thanks @​dyc3! - Added the nursery rule noNull, which reports uses of the null literal and suggests undefined instead. Strict comparisons such as foo === null are allowed.

  let foo = null;

• #12483 9bd3527 Thanks @​dyc3! - Added the nursery rule noReturnArrayPush, which reports code that uses the return value of push() or unshift(). These methods return the new length of the array, not the added item or the array.

  function add(item) {
    return items.push(item);
  }

• #12477 a384892 Thanks @​dyc3! - Added the nursery rule noUnreadableIife, which reports arrow functions that are called right where they are defined and whose body is wrapped in parentheses.

  const foo = (bar => (bar ? bar.baz : baz))(getBar());

• #12447 0a963e4 Thanks @​dyc3! - Added the nursery rule noUselessRecursion, which reports functions that return a call to themselves when a loop can do the same work. Too many nested calls can crash the program with a stack overflow error.

  function findRoot(node) {
      if (node.parent) {
          return findRoot(node.parent);
      }
      return node;
  }

• #12554 2eddda9 Thanks @​dyc3! - Added the nursery rule noVueComputedPropertiesInData, which reports computed properties used inside the data function of a Vue component. Vue runs data before it sets up computed properties, so the value read there is undefined.

... (truncated)

Commits

• 5653874 ci: release (#12647)
• 824df15 feat(lint): add noVueDeprecatedDeleteSet (#12586)
• 861b288 feat(lint): add noVueUnusedRefs (#12603)
• 2eddda9 feat(lint): add noVueComputedPropertiesInData (#12554)
• 5d7553b feat(lint): add noVueMultipleSlotArgs (#12562)
• de1188f feat(lint): add noVueDeprecatedScopeAttribute (#12631)
• 2e520d8 feat(lint): add noVueMutatingProps (#12513)
• ade9845 feat(lint): add useVueDefineOptions (#12615)
• 6fc1a51 feat(lint): add noVueDeprecatedRouterLinkTagProp (#12648)
• a810209 feat(lint): add useVueValidDefineEmits (#12591)
• Additional commits viewable in compare view

Updates @microsoft/tsdoc-config from 0.18.1 to 0.18.3

Changelog

Sourced from @​microsoft/tsdoc-config's changelog.

0.18.3

Tue, 29 Sep 2026 18:52:33 GMT

Version update only

0.18.2

Wed, 16 Sep 2026 01:24:29 GMT

Version update only

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for @​microsoft/tsdoc-config since your current version.

Updates @types/node from 26.5.0 to 26.6.6

Commits

• See full diff in compare view

Updates cspell from 10.3.0 to 10.4.0

Release notes

Sourced from cspell's releases.

v10.4.0

Features

feat: Add --glob-symlinks to follow symbolic links when matching globs (#9342)

Summary

cspell lint can now follow symbolic links in glob searches, with --glob-symlinks. Glob searches skip linked files and linked directories by default, so a tree made of links, such as Bazel runfiles, found nothing to check.

Closes #7700.

Feature

cspell lint --glob-symlinks "**"

• --glob-symlinks follows symbolic links, and searches linked directories, when matching globs. Links are followed wherever they point.
• CSPELL_GLOB_SYMLINKS=true does the same for a whole job. --no-glob-symlinks overrides it.
• API: globSymlinks in the lint options.
• It can't be set in a configuration file.
• Files are reported by the path through the link. A file reached by two paths is checked under both.
• It applies only to glob searches. For --file, --files, and --file-list documents, use --follow-symlinks.

• The design decisions are recorded in docs/ADRs/glob-symlinks/.
• Link loops, such as a link to a parent directory, are stopped by the glob search after one level.

---

feat: Respect COLUMNS for help and table width (#9358)

Summary

Help, and the tables from cspell trace and cspell dictionaries, now follow the COLUMNS environment variable. That lets you choose a narrower width, which helps with large fonts and screen magnifiers. The help in the cspell README now fits on npmjs.com without scrolling sideways.

Feature

Set COLUMNS to pick the output width:

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.4.0 (2026-10-14)

Features

feat: Add --glob-symlinks to follow symbolic links when matching globs (#9342)

Summary

cspell lint can now follow symbolic links in glob searches, with --glob-symlinks. Glob searches skip linked files and linked directories by default, so a tree made of links, such as Bazel runfiles, found nothing to check.

Closes #7700.

Feature

cspell lint --glob-symlinks "**"

• --glob-symlinks follows symbolic links, and searches linked directories, when matching globs. Links are followed wherever they point.
• CSPELL_GLOB_SYMLINKS=true does the same for a whole job. --no-glob-symlinks overrides it.
• API: globSymlinks in the lint options.
• It can't be set in a configuration file.
• Files are reported by the path through the link. A file reached by two paths is checked under both.
• It applies only to glob searches. For --file, --files, and --file-list documents, use --follow-symlinks.

• The design decisions are recorded in docs/ADRs/glob-symlinks/.
• Link loops, such as a link to a parent directory, are stopped by the glob search after one level.

---

feat: Respect COLUMNS for help and table width (#9358)

Summary

Help, and the tables from cspell trace and cspell dictionaries, now follow the COLUMNS environment variable. That lets you choose a narrower width, which helps with large fonts and screen magnifiers. The help in the cspell README now fits on npmjs.com without scrolling sideways.

Feature

... (truncated)

Commits

• 7e2bbb5 v10.4.0
• d2dce3f chore: Prepare Release v10.4.0 (auto-deploy) (#9380)
• a1509fe chore: Fix the README build after the inject-markdown 6 upgrade (#9429)
• ab3ae04 fix: Workflow Bot -- Update Dictionaries (main) (#9405)
• 55c0fbd fix: Show hidden lint options and issue template help in cspell --help (#9387)
• 628768a v10.4.0-alpha.1
• 998957b chore: Prepare Release v10.4.0-alpha.1 (auto-deploy) (#9378)
• 4c287f5 fix: Deprecate cspell-lib/rpc; import from @cspell/rpc (#9376)
• 7be53ce chore: Prepare Release v10.4.0-alpha.0 (auto-deploy) (#9332)
• e3b5887 chore: Update README.md (#9368)
• Additional commits viewable in compare view

Updates eslint from 10.10.0 to 10.14.0

Release notes

Sourced from eslint's releases.

v10.14.0

Features

• d23a7f9 feat: fix property descriptor handling in func-name-matching (#21400) (xbinaryx)

Bug Fixes

• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460) (lumir)
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449) (xbinaryx)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419) (lumir)
• 6194939 fix: no-invalid-this crash on accessor fields without initializer (#21442) (xbinaryx)
• 9155e14 fix: Update @​humanfs/node dependency version (#21434) (Nicholas C. Zakas)
• cb2b9d4 fix: avoid invalid object-shorthand fixes for super methods (#21323) (dvd233)
• 5ee3915 fix: yoda invalid autofix at statement start (#21424) (Daniel Pinto)

Documentation

• 0f94f47 docs: remove zh-hans from docs language switcher (#21437) (lumir)
• dab466e docs: Update README (GitHub Actions Bot)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452) (Pixel)
• 7697550 docs: Update README (GitHub Actions Bot)
• 0c699d5 docs: Remove Tidelift commercial support (#21416) (Milos Djermanovic)
• 0880666 docs: update loadESLint() documentation for v10 (#21374) (Minseon Kim)
• e06fe87 docs: Revise AI acknowledgment options in PR template (#21414) (Nicholas C. Zakas)

Chores

• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462) (Francesco Trotta)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450) (renovate[bot])
• a031c40 chore: update ecosystem plugins (#21445) (ESLint Bot)
• 67d2ca2 chore: add troubleshooting page URL to circular fixes warning message (#21429) (Milos Djermanovic)
• 276021d chore: update github/codeql-action action to v4.39.0 (#21432) (renovate[bot])
• 449724e chore: update ecosystem plugins (#21420) (ESLint Bot)
• 8ffeb8c chore: update dependency prettier to v3.9.10 (#21417) (renovate[bot])

v10.13.0

Features

• 48d5cc4 feat: report references inside IIFEs in no-use-before-define (#21238) (Irfan fandi)
• a39d9fb feat: add globalThis to no-obj-calls (#21382) (synthex-byte)
• 66ac583 feat: check yield* expressions in no-unsafe-optional-chaining (#21399) (xbinaryx)

Bug Fixes

• 87bd2ce fix: avoid redeclared let when no-var and one-var fix together (#21389) (Daniel Pinto)

Documentation

• 4783a68 docs: Update README (GitHub Actions Bot)
• 43f0ac9 docs: clarify parameter description in getText (#21287) (lumir)

Chores

• b59d889 chore: update github/codeql-action action to v4.38.3 (#21412) (renovate[bot])
• 95e51a0 ci: re-enable @typescript-eslint/typescript-eslint in ecosystem tests (#21410) (Francesco Trotta)
• 317fcb3 chore: update ecosystem plugins (#21409) (ESLint Bot)
• b92decf perf: skip no-redeclare scan for single-declaration variables (#21365) (James Ross)
• 47b7063 chore: update dependency @​eslint/json to ^2.1.1 (#21398) (renovate[bot])

... (truncated)

Commits

• 12cbff4 10.14.0
• 6b696e7 Build: changelog update for 10.14.0
• 0e2ab70 ci: disable eslint-plugin-unicorn ecosystem test (#21462)
• 4a12580 fix: require minimatch 10.2.6 to avoid vulnerable brace-expansion (#21460)
• 0f94f47 docs: remove zh-hans from docs language switcher (#21437)
• dab466e docs: Update README
• 827a8f3 fix: no-restricted-globals crash on global objects as property values (#21449)
• 97431f8 docs: replace --rulesdir with a virtual plugin in custom rules docs (#21452)
• 6e3f988 chore: update github/codeql-action action to v4.39.1 (#21450)
• 161558a fix: handle LS, PS and empty hashbang comments (#21419)
• Additional commits viewable in compare view

Updates eslint-plugin-tsdoc from 0.5.2 to 0.5.4

Changelog

Sourced from eslint-plugin-tsdoc's changelog.

0.5.4

Tue, 29 Sep 2026 18:52:33 GMT

Version update only

0.5.3

Wed, 16 Sep 2026 01:24:29 GMT

Patches

• Declare eslint as an optional peer dependency so published typings resolve against the consumer's ESLint under non-hoisted installers.

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for eslint-plugin-tsdoc since your current version.

Updates playwright from 1.62.1 to 1.64.1

Release notes

Sourced from playwright's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates typescript-eslint from 8.70.0 to 8.72.1

Release notes

Sourced from typescript-eslint's releases.

v8.72.1

8.72.1 (2026-10-26)

🩹 Fixes

• eslint-plugin: [no-unnecessary-condition] false positives on unresolved conditional types (#13062)
• eslint-plugin: [no-unnecessary-type-assertion] bound recursive type traversal instead of catching stack overflows (#13039)
• typescript-estree: use one Program per tsconfig for the project service in single-run mode (#12988)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Josh Ghoulberg 👻

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.72.0

8.72.0 (2026-10-19)

🚀 Features

• eslint-plugin: lazy load rules (#13010)
• eslint-plugin: [await-thenable] add allowMixedPromiseArrays option (#12992)
• typescript-estree: error on abstract keyword that precedes export (#13019)

🩹 Fixes

• ast-spec: add JSXFragment to JSXAttribute['value'] (#13051)
• eslint-plugin: [prefer-readonly-parameter-types] check where allowed type aliases are declared (#13016)
• eslint-plugin: [no-deprecated] report deprecated properties in object literals (#12704)
• eslint-plugin: use isTypeLiteralType instead of type.isLiteral() to include bigint literals on TS < 5.0 (#13053)
• eslint-plugin: [require-array-sort-compare] check tuples (#13058)
• eslint-plugin: [require-array-sort-compare] ignore extra this type argument on TS < 5.1 (#13055)
• type-utils: discriminateAnyType crashes when calling getAwaitedType on awaited type in TS < 5.0 (#13054)
• typescript-estree: include leading and trailing comments & whitespace in Program range (#12991)

❤️ Thank You

• Evyatar Daud @​StyleShit
• Junichiro Kasuya @​jksy
• Mitch Fultz @​fitchmultz
• Shaan GS @​ShaanGS

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.71.2

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.72.1 (2026-10-26)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.72.0 (2026-10-19)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.2 (2026-10-12)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.1 (2026-10-05)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.71.0 (2026-09-28)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.70.1 (2026-09-21)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 4ad6b75 chore(release): publish 8.72.1
• 7757694 chore: cleanup typecheck & build and fix race condition (#13071)
• a4c2603 chore(release): publish 8.72.0
• 7488d68 chore(release): publish 8.71.2
• d57b8da chore(release): publish 8.71.1
• 8695664 chore(release): publish 8.71.0
• 23d38ce chore(release): publish 8.70.1
• eb42d9b chore: cleanup and fix Nx dependencies and missing tasks (#12897)
• 8c80531 chore: fix typos in comments and docs (#12846)
• b6b86a1 chore: migrate to nx 23.2.0 (#12843)
• See full diff in compare view

Updates vite from 8.2.4 to 8.3.5

Release notes

Sourced from vite's releases.

v8.3.5

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

v8.3.4

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.5 (2026-10-21)

Bug Fixes

• build: handle missing chunk import maps (#23777) (8d7623d)
• build: include preload dependencies to chunk import map hashing (#23793) (4d16e7c)
• bundled-dev: apply server.origin to asset URLs (#23683) (52ba877)
• bundled-dev: declare utf-8 charset in fallback page (#23846) (197daf6)
• bundled-dev: ignore build.chunkImportMap (#23685) (cfe917d)
• bundled-dev: include user import.meta.env.* defines in the import.meta.env object (#23713) (6019aa7)
• bundled-dev: map forwarded error stacks through the bundle source maps (#23741) (11fe1e4)
• bundled-dev: normalize served output files (#23684) (df4e02c)
• bundled-dev: stop hmr propagation at modules that are no longer imported (#23839) (7471e8c)
• css: don't fail on a literal % in url() (#23676) (50b382d)
• deps: update all non-major dependencies (#23731) (cf80aa5)
• deps: update all non-major dependencies (#23826) (77d8373)
• deps: update rolldown-related dependencies (#23733) (43f0d05)
• deps: update rolldown-related dependencies (#23827) (c2e0418)
• optimizer: fall back to yarn.lock for lockfile hash (#23667) (f206096)
• optimizer: scan oxc.jsxInject imports (#23758) (38f3cb4)
• optimizer: skip patches dir check for yarn.lock fallback (#23725) (8e890e1)
• optimizer: skip patches dir hash for nub lockfile (#23761) (a7d5696)
• resolve: support subpath imports with multiple # (#23631) (0d86b34)
• resolve: update resolve.exports to 2.0.4 (#23739) (4ea708a)
• server: handle socket errors on upgrade requests not taken by the HMR server (#23728) (c2c9ef4)
• server: only strip base when path matches a full segment (#23641) (3dfde87)

Performance Improvements

• ssr: extract inline source maps without a regexp (#23775) (6a02780)

Miscellaneous Chores

• migrate to Oxlint (#23746) (5b73935)

Code Refactoring

• deps: replace @vercel/detect-agent with std-env (#23744) (ce4293f)
• dev: consolidate moduleURL to file path utilities (#23828) (df7b40e)
• dev: separate import resolution from URL conversion (#23791) (6116689)
• dev: share ModuleURL and BrowserURL conversions (#23790) (446954c)
• dev: use ModuleURLs throughout HTML transforms (#23815) (a162990)

8.3.4 (2026-10-08)

Features

• bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

• avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

... (truncated)

Commits

• 981f07f release: v8.3.5 (#23856)
• 0d86b34 fix(resolve): support subpath imports with multiple # (#23631)
• 6a02780 perf(ssr): extract inline source maps without a regexp (#23775)
• 8e890e1 fix(optimizer): skip patches dir check for yarn.lock fallback (