Bump the npm-dependencies group across 1 directory with 12 updates by dependabot[bot] · Pull Request #1025 · brisbanesocialchess/brisbanesocialchess.github.io

dependabot · 2026-03-20T02:46:17Z

Bumps the npm-dependencies group with 12 updates in the / directory:

Package	From	To
@biomejs/biome	`2.4.4`	`2.4.6`
@cloudflare/vitest-pool-workers	`0.12.18`	`0.12.21`
@npmcli/arborist	`9.3.1`	`9.4.1`
@vitest/coverage-istanbul	`3.2.4`	`4.1.0`
@vitest/coverage-v8	`3.2.4`	`4.1.0`
esbuild	`0.27.3`	`0.27.4`
eslint	`10.0.2`	`10.0.3`
globals	`17.3.0`	`17.4.0`
lerna	`9.0.4`	`9.0.6`
postcss	`8.5.6`	`8.5.8`
svgo	`4.0.0`	`4.0.1`
vitest	`3.2.4`	`4.1.0`

Updates @biomejs/biome from 2.4.4 to 2.4.6

Release notes

Sourced from @biomejs/biome's releases.

Biome CLI v2.4.6

2.4.6

Patch Changes
#9305 40869b5 Thanks @ematipico! - Fixed #4946: noUnreachable no longer reports code inside finally blocks as unreachable when there is a break, continue, or return in the corresponding try body.

#9303 464910c Thanks @ematipico! - Fixed #2786: The formatter no longer produces different output on subsequent runs when a case clause has a trailing line comment followed by a single block statement.

#9324 6294aa2 Thanks @arendjr! - Fixed [#7730](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7730): useAnchorContent now recognises SolidJS's innerHTML the same way as React's dangerouslySetInnerHTML.

#9298 1003229 Thanks @Netail! - Fixed [#9296](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/9296), so comments are moved along with the attributes in the useSortedAttributes assist rule code fix.

#9329 855b451 Thanks @dyc3! - Improved performance of noEmptyBlockStatements. The rule is now smarter about short-circuiting its logic.

#9326 85dfe9b Thanks @dyc3! - Improved performance for noImportCycles by explicitly excluding node_modules from the cycle detection. The performance improvement is directly proportional to how big your dependency tree is.

#9323 d5ee469 Thanks @ematipico! - Fixed #9217 and biomejs/biome-vscode#959, where the Biome language server didn't correctly resolve the editor setting configurationPath when the provided value is a relative path.
#9302 86fbc70 Thanks @sepagian! - Fixed #9300: Lowercase component member expressions like <form.Field> in Svelte and Astro files are now correctly formatted.
-<form .Field></form.Field>
+<form.Field></form.Field>
What's Changed

fix(js_analyze): move comments with useSortedAttributes action by @Netail in biomejs/biome#9298

fix(formatter): switch case comments by @ematipico in biomejs/biome#9303

refactor(markdown-parser): promote list structural tokens from skipped trivia to explicit CST nodes by @jfmcdowell in biomejs/biome#9274

fix(noUnreachable): handle dead implicit jumps in finally by @ematipico in biomejs/biome#9305

refactor(markdown-parser): align newline/prescan paragraph-break checks by @jfmcdowell in biomejs/biome#9197

refactor(markdown-parser): promote blank lines between list items to MdNewline nodes by @jfmcdowell in biomejs/biome#9313

fix(linter): support SolidJS's innerHTML in useAnchorContent by @arendjr in biomejs/biome#9324

fix(lsp): correctly resolve configurationPath by @ematipico in biomejs/biome#9323

perf(noImportCycles): exclude node_modules from cycle detection by @dyc3 in biomejs/biome#9326

refactor(css_parser): split function parser into modules by @denbezrukov in biomejs/biome#9325

refactor(markdown-parser): promote fenced code block skipped trivia to explicit CST nodes by @jfmcdowell in biomejs/biome#9321

refactor(css): rename operator_token field to operator by @denbezrukov in biomejs/biome#9327

perf: add .skip(1) to .ancestors() calls in a bunch of places by @dyc3 in biomejs/biome#9330

perf(noEmptyBlockStatements): short circuit to avoid traversing descendants for comments by @dyc3 in biomejs/biome#9329

fix: lowercase component member expressions in Astro/Svelte by @sepagian in biomejs/biome#9302

chore: align parser options struct name by @Netail in biomejs/biome#9332

feat(css): use ScssExpression in ScssNestingDeclaration and CssGenericProperty by @denbezrukov in biomejs/biome#9328

refactor(css): align scss expression node variants by @denbezrukov in biomejs/biome#9340

feat(css): use expression in page by @denbezrukov in biomejs/biome#9342

ci: release by @github-actions[bot] in biomejs/biome#9301

... (truncated)

Changelog

Sourced from @biomejs/biome's changelog.

2.4.6

Patch Changes
#9305 40869b5 Thanks @ematipico! - Fixed #4946: noUnreachable no longer reports code inside finally blocks as unreachable when there is a break, continue, or return in the corresponding try body.

#9303 464910c Thanks @ematipico! - Fixed #2786: The formatter no longer produces different output on subsequent runs when a case clause has a trailing line comment followed by a single block statement.

#9324 6294aa2 Thanks @arendjr! - Fixed [#7730](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7730): useAnchorContent now recognises SolidJS's innerHTML the same way as React's dangerouslySetInnerHTML.

#9298 1003229 Thanks @Netail! - Fixed [#9296](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/9296), so comments are moved along with the attributes in the useSortedAttributes assist rule code fix.

#9329 855b451 Thanks @dyc3! - Improved performance of noEmptyBlockStatements. The rule is now smarter about short-circuiting its logic.

#9326 85dfe9b Thanks @dyc3! - Improved performance for noImportCycles by explicitly excluding node_modules from the cycle detection. The performance improvement is directly proportional to how big your dependency tree is.

#9323 d5ee469 Thanks @ematipico! - Fixed #9217 and biomejs/biome-vscode#959, where the Biome language server didn't correctly resolve the editor setting configurationPath when the provided value is a relative path.
#9302 86fbc70 Thanks @sepagian! - Fixed #9300: Lowercase component member expressions like <form.Field> in Svelte and Astro files are now correctly formatted.
-<form .Field></form.Field>
+<form.Field></form.Field>
2.4.5

Patch Changes
#9185 e43e730 Thanks @dyc3! - Added the nursery rule useVueScopedStyles for Vue SFCs. This rule enforces that <style> blocks have the scoped attribute (or module for CSS Modules), preventing style leakage and conflicts between components.

#9184 49c8fde Thanks @chocky335! - Improved plugin performance by batching all plugins into a single syntax visitor with a kind-to-plugin lookup map, reducing per-node dispatch overhead from O(N) to O(1) where N is the number of plugins.

#9283 071c700 Thanks @dyc3! - Fixed noUndeclaredVariables erroneously flagging functions and variables defined in the <script setup> section of Vue SFCs.

#9221 4612133 Thanks @ematipico! - Fixed an issue where the JSON reporter didn't contain the duration of the command.

#9294 1805c8f Thanks @Netail! - Extra rule source reference. biome migrate eslint should do a bit better detecting rules in your eslint configurations.
#9178 101b3bb Thanks @Bertie690! - Fixed #9172 and #9168: Biome now considers more constructs as valid test assertions.

Previously, assert, expectTypeOf and assertType were not recognized as valid assertions by Biome's linting rules, producing false positives in lint/nursery/useExpect and other similar rules.

Now, these rules will no longer produce errors in test cases that used these constructs instead of expect:
import { expectTypeOf, assert, assertType } from "vitest";

... (truncated)

Commits

cabc56c ci: release (#9301)
3bc07ab ci: release (#9188)
6b01778 feat(linter): add useUnicodeRegex rule (#8773)
e43e730 feat(lint/html): add useVueScopedStyles (#9185)
edf8bb6 feat(lint): add ||= to ??= detection in useNullishCoalescing (#9257)
9bbdf4d feat(lint): add nursery rule useNamedCaptureGroup (#9048)
1f2fe2e feat: prefer-array-some from eslint-plugin-unicorn (#9056)
1d2ca15 feat(lint): add useNullishCoalescing nursery rule (#8952)
101b3bb fix(lint): consider more constructs as valid test assertions (#9178)
3d0648f feat(biome_js_analyze): implement noVueRefAsOperand (#9063)
See full diff in compare view

Updates @cloudflare/vitest-pool-workers from 0.12.18 to 0.12.21

Release notes

Sourced from @cloudflare/vitest-pool-workers's releases.

@cloudflare/vitest-pool-workers@0.12.21

Patch Changes

#12790 5451a7f Thanks @petebacondarwin! - Bump devalue to ^5.6.3 to address security vulnerabilities

Devalue had denial of service and prototype pollution vulnerabilities. This is a bundled dependency.

Updated dependencies [5451a7f, 5451a7f, 82cc2a8, 3c67c2a, d645594, 211d75d, 6ed249b, 9f93b54, de65c58, cb14820, a7c87d1, b8c33f5, e4d9510]:

miniflare@4.20260310.0

wrangler@4.72.0

@cloudflare/vitest-pool-workers@0.12.20

Patch Changes

Updated dependencies [ec2459e]:

wrangler@4.71.0

miniflare@4.20260301.1

@cloudflare/vitest-pool-workers@0.12.19

Patch Changes

#12682 b5b91c9 Thanks @hiendv! - Fix resource leak where remote proxy sessions were not disposed during pool shutdown, causing vitest processes to hang.

Updated dependencies [6a8aa5f, d672e2e, 35b2c56, 5f7aaf2, 209b396, 23a365a, 596b8a0, 00e729e, 0769056, 150ef7b, bf9cb3d]:

wrangler@4.70.0

miniflare@4.20260301.1

Changelog

Sourced from @cloudflare/vitest-pool-workers's changelog.

0.12.21

Patch Changes

#12790 5451a7f Thanks @petebacondarwin! - Bump devalue to ^5.6.3 to address security vulnerabilities

Devalue had denial of service and prototype pollution vulnerabilities. This is a bundled dependency.

Updated dependencies [5451a7f, 5451a7f, 82cc2a8, 3c67c2a, d645594, 211d75d, 6ed249b, 9f93b54, de65c58, cb14820, a7c87d1, b8c33f5, e4d9510]:

miniflare@4.20260310.0

wrangler@4.72.0

0.12.20

Patch Changes

Updated dependencies [ec2459e]:

wrangler@4.71.0

miniflare@4.20260301.1

0.12.19

Patch Changes

#12682 b5b91c9 Thanks @hiendv! - Fix resource leak where remote proxy sessions were not disposed during pool shutdown, causing vitest processes to hang.

Updated dependencies [6a8aa5f, d672e2e, 35b2c56, 5f7aaf2, 209b396, 23a365a, 596b8a0, 00e729e, 0769056, 150ef7b, bf9cb3d]:

wrangler@4.70.0

miniflare@4.20260301.1

Commits

24f807b Version Packages (#12789)
5451a7f fix: bump vulnerable direct dependencies (#12790)
9dff00c Version Packages (#12748)
ea57dfd Version Packages (#12702)
35b2c56 containers: Add container and test Containers interceptOutboundHttp (#12649)
b5b91c9 fix(vitest-pool-workers): dispose remote proxy sessions on pool close (#12682)
See full diff in compare view

Updates @npmcli/arborist from 9.3.1 to 9.4.1

Release notes

Sourced from @npmcli/arborist's releases.

arborist: v9.4.1

9.4.1 (2026-03-10)

Bug Fixes

5b7c0cc #9096 arborist: exclude store nodes from :root > * in linked strategy (#9096) (@manzoorwanijk)

3b70a9d #9097 arborist: simplify rootDeclaredDeps initialization (#9097) (@manzoorwanijk)

c7702d0 #9094 arborist: fix non-idempotent linked install with workspace projects (#9094) (@manzoorwanijk)

1a744b5 #9081 arborist: omit root dev deps in linked strategy when shared with workspaces (#9081) (@manzoorwanijk)

ff51827 #9076 arborist: do not hoist undeclared workspaces in linked strategy (#9076) (@manzoorwanijk)

1206f8b #9069 consolidate isolated node/link attributes (#9069) (@wraithgar)

a774fb7 #9066 arborist: respect --omit flag in linked install strategy (#9066) (@manzoorwanijk)

8614b2a #9031 arborist: avoid full reinstall on subsequent linked strategy runs (#9031) (@manzoorwanijk)

16fbe13 #9030 resolve relative file: dependencies correctly with install-strategy=linked (#9030) (@manzoorwanijk)

983742b #9055 isolated mode code cleanup (#9055) (@wraithgar)

a29aeee #9028 arborist: retry bin-links on Windows EPERM (#9028) (@manzoorwanijk)

10d5302 #9051 arborist: unwrap Link nodes in legacyPeerDeps for linked strategy (#9051) (@manzoorwanijk)

94bfef5 #9044 audit: exclude locally linked packages from vulnerability audit (#9044) (@lucas-gomes-santana)

26fa40e #9041 fix workspace-filtered install with linked strategy (@owlstronaut)

arborist: v9.4.0

9.4.0 (2026-02-25)

Features

4fcd352 #9017 add :type(registry) to query selector syntax (#9017) (@wraithgar)

Bug Fixes

880ecb7 #9013 arborist: skip postinstall on store links in linked strategy (#9013) (@manzoorwanijk)

07e6edd #9025 save libc field to package-lock.json (@owlstronaut)

a2154cd #8996 linked strategy fixes for scoped packages, aliases, and peer deps (#8996) (@manzoorwanijk)

Changelog

Sourced from @npmcli/arborist's changelog.

9.4.1 (2026-03-10)

Bug Fixes

5b7c0cc #9096 arborist: exclude store nodes from :root > * in linked strategy (#9096) (@manzoorwanijk)

3b70a9d #9097 arborist: simplify rootDeclaredDeps initialization (#9097) (@manzoorwanijk)

c7702d0 #9094 arborist: fix non-idempotent linked install with workspace projects (#9094) (@manzoorwanijk)

1a744b5 #9081 arborist: omit root dev deps in linked strategy when shared with workspaces (#9081) (@manzoorwanijk)

ff51827 #9076 arborist: do not hoist undeclared workspaces in linked strategy (#9076) (@manzoorwanijk)

1206f8b #9069 consolidate isolated node/link attributes (#9069) (@wraithgar)

a774fb7 #9066 arborist: respect --omit flag in linked install strategy (#9066) (@manzoorwanijk)

8614b2a #9031 arborist: avoid full reinstall on subsequent linked strategy runs (#9031) (@manzoorwanijk)

16fbe13 #9030 resolve relative file: dependencies correctly with install-strategy=linked (#9030) (@manzoorwanijk)

983742b #9055 isolated mode code cleanup (#9055) (@wraithgar)

a29aeee #9028 arborist: retry bin-links on Windows EPERM (#9028) (@manzoorwanijk)

10d5302 #9051 arborist: unwrap Link nodes in legacyPeerDeps for linked strategy (#9051) (@manzoorwanijk)

94bfef5 #9044 audit: exclude locally linked packages from vulnerability audit (#9044) (@lucas-gomes-santana)

26fa40e #9041 fix workspace-filtered install with linked strategy (@owlstronaut)

9.4.0 (2026-02-25)

Features

4fcd352 #9017 add :type(registry) to query selector syntax (#9017) (@wraithgar)

Bug Fixes

880ecb7 #9013 arborist: skip postinstall on store links in linked strategy (#9013) (@manzoorwanijk)

07e6edd #9025 save libc field to package-lock.json (@owlstronaut)

a2154cd #8996 linked strategy fixes for scoped packages, aliases, and peer deps (#8996) (@manzoorwanijk)

Commits

bdf079d chore: release 9.4.1
721fe3f deps: read-package-json-fast@3.0.2
6e4a649 deps: pacote@15.0.8
1820afe deps: cacache@17.0.4
4b8046e deps: @npmcli/name-from-folder@2.0.0
1d4be7a deps: @npmcli/map-workspaces@3.0.1
a39556f deps: @npmcli/template-oss@4.11.3
72a7a59 fix: only save package-lock when truly finished
5ec35b7 chore: clean snapshot before code change
ad8deca chore: release 9.4.0
Additional commits viewable in compare view

Updates @vitest/coverage-istanbul from 3.2.4 to 4.1.0

Release notes

Sourced from @vitest/coverage-istanbul's releases.

v4.1.0

Vitest 4.1 is out!

This release page lists all changes made to the project during the 4.1 beta. To get a review of all the new features, read our blog post.

🚀 Features

Return a disposable from doMock() - by @kirkwaiblinger in vitest-dev/vitest#9332 (e3e65)

Added chai style assertions - by @ronnakamoto and @sheremet-va in vitest-dev/vitest#8842 (841df)

Update to sinon/fake-timers v15 and add setTickMode to timer controls - by @atscott and @sheremet-va in vitest-dev/vitest#8726 (4b480)

Expose matcher types - by @sheremet-va in vitest-dev/vitest#9448 (3e4b9)

Add toTestSpecification to reported tasks - by @sheremet-va in vitest-dev/vitest#9464 (1a470)

Show a warning if vi.mock or vi.hoisted are declared outside of top level of the module - by @sheremet-va in vitest-dev/vitest#9387 (5db54)

Track and display expectedly failed tests (.fails) in UI and CLI - by @Copilot, sheremet-va and @sheremet-va in vitest-dev/vitest#9476 (77d75)

Support tags - by @sheremet-va in vitest-dev/vitest#9478 (de7c8)

Implement aroundEach and aroundAll hooks - by @sheremet-va in vitest-dev/vitest#9450 (2a8cb)

Stabilize experimental features - by @sheremet-va in vitest-dev/vitest#9529 (b5fd2)

Accept new or all in --update flag - by @sheremet-va in vitest-dev/vitest#9543 (a5acf)

Support meta in test options - by @sheremet-va in vitest-dev/vitest#9535 (7d622)

Support type inference with a new test.extend syntax - by @sheremet-va in vitest-dev/vitest#9550 (e5385)

Support vite 8 beta, fix type issues in the config with different vite versions - by @sheremet-va in vitest-dev/vitest#9587 (99028)

Add assertion helper to hide internal stack traces - by @hi-ogawa and Claude Opus 4.6 in vitest-dev/vitest#9594 (eeb0a)

Store failure screenshots using artifacts API - by @macarie in vitest-dev/vitest#9588 (24603)

Allow vitest list to statically collect tests instead of running files to collect them - by @sheremet-va in vitest-dev/vitest#9630 (7a8e7)

Add --detect-async-leaks - by @AriPerkkio in vitest-dev/vitest#9528 (c594d)

Implement mockThrow and mockThrowOnce - by @thor-juhasz and @sheremet-va in vitest-dev/vitest#9512 (61917)

Support update: "none" and add docs about snapshots behavior on CI - by @hi-ogawa in vitest-dev/vitest#9700 (05f18)

Support playwright launchOptions with connectOptions - by @hi-ogawa in vitest-dev/vitest#9702 (f0ff1)

Add page/locator.mark API to enhance playwright trace - by @hi-ogawa in vitest-dev/vitest#9652 (d0ee5)

api:

Support tests starting or ending with test in experimental_parseSpecification - by @jgillick and Jeremy Gillick in vitest-dev/vitest#9235 (2f367)

Add filters to createSpecification - by @sheremet-va in vitest-dev/vitest#9336 (c8e6c)

Expose runTestFiles as alternative to runTestSpecifications - by @sheremet-va in vitest-dev/vitest#9443 (43d76)

Add allowWrite and allowExec options to api - by @sheremet-va in vitest-dev/vitest#9350 (20e00)

Allow passing down test cases to toTestSpecification - by @sheremet-va in vitest-dev/vitest#9627 (6f17d)

browser:

Add userEvent.wheel API - by @macarie in vitest-dev/vitest#9188 (66080)

Add filterNode option to prettyDOM for filtering browser assertion error output - by @Copilot, sheremet-va and @sheremet-va in vitest-dev/vitest#9475 (d3220)

Support playwright persistent context - by @hi-ogawa, Claude Opus 4.6 and @sheremet-va in vitest-dev/vitest#9229 (f865d)

Added detailsPanelPosition option and button - by @shairez in vitest-dev/vitest#9525 (c8a31)

Use BlazeDiff instead of pixelmatch - by @macarie in vitest-dev/vitest#9514 (30936)

Add findElement and enable strict mode in webdriverio and preview - by @sheremet-va in vitest-dev/vitest#9677 (c3f37)

cli:

Add @bomb.sh/tab completions - by @AmirSa12 and @sheremet-va in vitest-dev/vitest#8639

Bumps the npm-dependencies group with 12 updates in the / directory: | Package | From | To | | --- | --- | --- | | [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.4` | `2.4.6` | | [@cloudflare/vitest-pool-workers](https://github.com/cloudflare/workers-sdk/tree/HEAD/packages/vitest-pool-workers) | `0.12.18` | `0.12.21` | | [@npmcli/arborist](https://github.com/npm/cli/tree/HEAD/workspaces/arborist) | `9.3.1` | `9.4.1` | | [@vitest/coverage-istanbul](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-istanbul) | `3.2.4` | `4.1.0` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `3.2.4` | `4.1.0` | | [esbuild](https://github.com/evanw/esbuild) | `0.27.3` | `0.27.4` | | [eslint](https://github.com/eslint/eslint) | `10.0.2` | `10.0.3` | | [globals](https://github.com/sindresorhus/globals) | `17.3.0` | `17.4.0` | | [lerna](https://github.com/lerna/lerna/tree/HEAD/packages/lerna) | `9.0.4` | `9.0.6` | | [postcss](https://github.com/postcss/postcss) | `8.5.6` | `8.5.8` | | [svgo](https://github.com/svg/svgo) | `4.0.0` | `4.0.1` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `3.2.4` | `4.1.0` | Updates `@biomejs/biome` from 2.4.4 to 2.4.6 - [Release notes](https://github.com/biomejs/biome/releases) - [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md) - [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.6/packages/@biomejs/biome) Updates `@cloudflare/vitest-pool-workers` from 0.12.18 to 0.12.21 - [Release notes](https://github.com/cloudflare/workers-sdk/releases) - [Changelog](https://github.com/cloudflare/workers-sdk/blob/main/packages/vitest-pool-workers/CHANGELOG.md) - [Commits](https://github.com/cloudflare/workers-sdk/commits/@cloudflare/vitest-pool-workers@0.12.21/packages/vitest-pool-workers) Updates `@npmcli/arborist` from 9.3.1 to 9.4.1 - [Release notes](https://github.com/npm/cli/releases) - [Changelog](https://github.com/npm/cli/blob/latest/workspaces/arborist/CHANGELOG.md) - [Commits](https://github.com/npm/cli/commits/v9.4.1/workspaces/arborist) Updates `@vitest/coverage-istanbul` from 3.2.4 to 4.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/coverage-istanbul) Updates `@vitest/coverage-v8` from 3.2.4 to 4.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/coverage-v8) Updates `esbuild` from 0.27.3 to 0.27.4 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.27.3...v0.27.4) Updates `eslint` from 10.0.2 to 10.0.3 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.0.2...v10.0.3) Updates `globals` from 17.3.0 to 17.4.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.3.0...v17.4.0) Updates `lerna` from 9.0.4 to 9.0.6 - [Release notes](https://github.com/lerna/lerna/releases) - [Changelog](https://github.com/lerna/lerna/blob/main/packages/lerna/CHANGELOG.md) - [Commits](https://github.com/lerna/lerna/commits/v9.0.6/packages/lerna) Updates `postcss` from 8.5.6 to 8.5.8 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.6...8.5.8) Updates `svgo` from 4.0.0 to 4.0.1 - [Release notes](https://github.com/svg/svgo/releases) - [Commits](svg/svgo@v4.0.0...v4.0.1) Updates `vitest` from 3.2.4 to 4.1.0 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.0/packages/vitest) --- updated-dependencies: - dependency-name: "@biomejs/biome" dependency-version: 2.4.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@cloudflare/vitest-pool-workers" dependency-version: 0.12.21 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: "@npmcli/arborist" dependency-version: 9.4.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: "@vitest/coverage-istanbul" dependency-version: 4.1.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies - dependency-name: esbuild dependency-version: 0.27.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: eslint dependency-version: 10.0.3 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: globals dependency-version: 17.4.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: npm-dependencies - dependency-name: lerna dependency-version: 9.0.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: postcss dependency-version: 8.5.8 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: svgo dependency-version: 4.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies - dependency-name: vitest dependency-version: 4.1.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

cloudflare-workers-and-pages · 2026-03-20T02:46:19Z

Deploying brisbanesocialchess with Cloudflare Pages

Latest commit:	`eb6631a`
Status:	🚫 Build failed.

View logs

github-actions · 2026-03-20T02:46:30Z

Thanks for your first pull request! We appreciate your contribution.

deepsource-io · 2026-03-20T02:46:34Z

DeepSource Code Review

We reviewed changes in 076c40d...eb6631a on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade	Security Reliability Complexity Hygiene

Code Review Summary

Analyzer	Updated (UTC)	Details
Docker	Mar 20, 2026 2:46a.m.	Review ↗
JavaScript	Mar 20, 2026 2:46a.m.	Review ↗
Python	Mar 20, 2026 2:46a.m.	Review ↗
Secrets	Mar 20, 2026 2:46a.m.	Review ↗

socket-security · 2026-03-20T02:47:01Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@npmcli/arborist@9.3.1 ⏵ 9.4.1	^-1	⁺¹	⁺¹
esbuild@0.27.4
@cloudflare/vitest-pool-workers@0.12.21
vitest@3.2.4
@vitest/coverage-v8@3.2.4 ⏵ 4.1.0	⁺¹	⁺⁸	⁺¹
@vitest/coverage-istanbul@3.2.4 ⏵ 4.1.0	⁺¹	⁺¹⁵
lerna@9.0.4 ⏵ 9.0.6	⁺⁶	⁺¹	⁺²
globals@17.3.0 ⏵ 17.4.0	⁺¹	⁺¹
eslint@10.0.2 ⏵ 10.0.3	⁺¹
wrangler@4.69.0
@biomejs/biome@2.4.4 ⏵ 2.4.6	⁺¹		⁺²

View full report

socket-security · 2026-03-20T02:47:03Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		High CVE: Rollup 4 has Arbitrary File Write via Path Traversal CVE: GHSA-mw96-cpmx-2vgc Rollup 4 has Arbitrary File Write via Path Traversal (HIGH) Affected versions: < 2.80.0; >= 3.0.0 < 3.30.0; >= 4.0.0 < 4.59.0 Patched version: 4.59.0 From: packages/cfsite/package-lock.json → `npm/vitest@3.2.4` → `npm/rollup@4.50.0` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/rollup@4.50.0`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation CVE: GHSA-v9p9-hfj2-hcw8 Undici has Unhandled Exception in WebSocket Client Due to Invalid server_max_window_bits Validation (HIGH) Affected versions: < 6.24.0; >= 7.0.0 < 7.24.0 Patched version: 7.24.0 From: packages/cfsite/package-lock.json → `npm/@cloudflare/vitest-pool-workers@0.12.18` → `npm/wrangler@4.69.0` → `npm/undici@7.18.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/undici@7.18.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression CVE: GHSA-vrm6-8vpv-qv8q Undici has Unbounded Memory Consumption in WebSocket permessage-deflate Decompression (HIGH) Affected versions: < 6.24.0; >= 7.0.0 < 7.24.0 Patched version: 7.24.0 From: packages/cfsite/package-lock.json → `npm/@cloudflare/vitest-pool-workers@0.12.18` → `npm/wrangler@4.69.0` → `npm/undici@7.18.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/undici@7.18.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		High CVE: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client CVE: GHSA-f269-vfmq-vjvj Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client (HIGH) Affected versions: >= 6.0.0 < 6.24.0; >= 7.0.0 < 7.24.0 Patched version: 7.24.0 From: packages/cfsite/package-lock.json → `npm/@cloudflare/vitest-pool-workers@0.12.18` → `npm/wrangler@4.69.0` → `npm/undici@7.18.2` ℹ Read more on: This package \| This alert \| What is a CVE? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Remove or replace dependencies that include known high severity CVEs. Consumers can use dependency overrides or npm audit fix --force to remove vulnerable dependencies. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/undici@7.18.2`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.
Warn		Obfuscated code: npm `vite` is 91.0% likely obfuscated Confidence: 0.91 Location: Package overview From: packages/cfsite/package-lock.json → `npm/vitest@3.2.4` → `npm/vite@7.1.5` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `support@socket.dev`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/vite@7.1.5`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

BaseMax

OK

dependabot · 2026-03-23T02:47:25Z

Looks like these dependencies are updatable in another way, so this is no longer needed.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 20, 2026

dependabot Bot requested a review from jbampton as a code owner March 20, 2026 02:46

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Mar 20, 2026

github-project-automation Bot added this to Chess Mar 20, 2026

github-project-automation Bot moved this to Backlog in Chess Mar 20, 2026

github-actions Bot added root backend labels Mar 20, 2026

BaseMax approved these changes Mar 20, 2026

View reviewed changes

dependabot Bot closed this Mar 23, 2026

github-project-automation Bot moved this from Backlog to Done in Chess Mar 23, 2026

dependabot Bot deleted the dependabot/npm_and_yarn/npm-dependencies-06633a9568 branch March 23, 2026 02:47

Navigation Menu

Uh oh!

Bump the npm-dependencies group across 1 directory with 12 updates - #1025

Bump the npm-dependencies group across 1 directory with 12 updates#1025
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/npm-dependencies-06633a9568

dependabot Bot commented on behalf of github Mar 20, 2026 •

edited

Loading

Uh oh!

cloudflare-workers-and-pages Bot commented Mar 20, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Mar 20, 2026

Uh oh!

deepsource-io Bot commented Mar 20, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Mar 20, 2026

Uh oh!

socket-security Bot commented Mar 20, 2026

Uh oh!

BaseMax left a comment

Uh oh!

dependabot Bot commented on behalf of github Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

dependabot Bot commented on behalf of github Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Biome CLI v2.4.6

2.4.6

Patch Changes

What's Changed

2.4.6

Patch Changes

2.4.5

Patch Changes

@​cloudflare/vitest-pool-workers@​0.12.21

Patch Changes

@​cloudflare/vitest-pool-workers@​0.12.20

Patch Changes

@​cloudflare/vitest-pool-workers@​0.12.19

Patch Changes

0.12.21

Patch Changes

0.12.20

Patch Changes

0.12.19

Patch Changes

arborist: v9.4.1

9.4.1 (2026-03-10)

Bug Fixes

arborist: v9.4.0

9.4.0 (2026-02-25)

Features

Bug Fixes

9.4.1 (2026-03-10)

Bug Fixes

9.4.0 (2026-02-25)

Features

Bug Fixes

v4.1.0

🚀 Features

Uh oh!

cloudflare-workers-and-pages Bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Deploying brisbanesocialchess with Cloudflare Pages

Uh oh!

github-actions Bot commented Mar 20, 2026

Uh oh!

deepsource-io Bot commented Mar 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

DeepSource Code Review

PR Report Card

Code Review Summary

Uh oh!

socket-security Bot commented Mar 20, 2026

Uh oh!

socket-security Bot commented Mar 20, 2026

Uh oh!

BaseMax left a comment

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Mar 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

dependabot Bot commented on behalf of github Mar 20, 2026 •

edited

Loading

`@cloudflare/vitest-pool-workers@0`.12.21

`@cloudflare/vitest-pool-workers@0`.12.20

`@cloudflare/vitest-pool-workers@0`.12.19

cloudflare-workers-and-pages Bot commented Mar 20, 2026 •

edited

Loading

deepsource-io Bot commented Mar 20, 2026 •

edited

Loading