chore(deps): bump the all-npm group across 1 directory with 8 updates

[dependabot]

Bumps the all-npm group with 8 updates in the / directory:

Package	From	To
@github/copilot-sdk	0.3.0	1.0.1
tsx	4.22.3	4.22.4
@playwright/test	1.60.0	1.61.0
eslint	10.4.0	10.5.0
eslint-plugin-security	4.0.0	4.0.1
lint-staged	17.0.5	17.0.7
prettier	3.8.3	3.8.4
better-sqlite3	12.10.0	12.10.1

Updates @github/copilot-sdk from 0.3.0 to 1.0.1

Release notes

Sourced from @​github/copilot-sdk's releases.

GitHub Copilot SDK for Java 1.0.1

Installation

⚠️ Artifact versioning plan: Releases of this implementation track releases of the reference implementation. For each release of the reference implementation, there may follow a corresponding release of this implementation with the same number as the reference implementation. Release identifiers of the reference implementation are in the form vMaj.Min.Micro. For example v0.1.32. The corresponding maven version for the release will be Maj.Min.Micro-java.N, where Maj, Min and Micro are the corresponding numbers for the reference implementation release, and N is a monotonically increasing sequence number starting with 0 for each release. See the corresponding architectural decision record for more information in the docs/adr directory of the source code.

📦 [View on Maven Central](https://github.com/github/copilot-sdk/blob/HEAD/(central.sonatype.com/redacted)

📖 [Documentation](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted) · [Javadoc](https://github.com/github/copilot-sdk/blob/HEAD/(github.github.io/redacted)

Maven

<dependency>
    <groupId>com.github</groupId>
    <artifactId>copilot-sdk-java</artifactId>
    <version>1.0.1</version>
</dependency>

Gradle (Kotlin DSL)

implementation("com.github:copilot-sdk-java:1.0.1")

Gradle (Groovy DSL)

implementation 'com.github:copilot-sdk-java:1.0.1'

---

Feature: @CopilotExperimental compile-time gate for experimental APIs

Experimental SDK APIs are now guarded by the @CopilotExperimental annotation. Using them causes a compile error by default; opt in by annotating the consuming class or method with @AllowCopilotExperimental, or pass -Acopilot.experimental.allowed=true to the Java compiler. (#1601)

`@AllowCopilotExperimental`
public class MyHandler {
    // may use `@CopilotExperimental` APIs here
}

Feature: open-canvases snapshot on CopilotSession

CopilotSession.getOpenCanvases() now returns the live set of canvas instances open for the session, bringing the Java SDK to parity with the other SDK languages. The snapshot is seeded from the session create/resume response and kept current via session.canvas.opened and session.canvas.closed events. (#1606)

List<OpenCanvasInstance> open = session.getOpenCanvases();

... (truncated)

Commits

• f2e8469 # Java codegen: clean output directory before generating to prevent orphan ac...
• 53ffb24 Update @​github/copilot to 1.0.61 (#1612)
• 3cbeae5 Add E2E coverage for newly added RPC methods across all SDKs (#1610)
• 9e9cfbe Add @CopilotExperimental compile-time gate for experimental APIs (#1601)
• 391bcd4 Handle session.canvas.closed by removing from open_canvases snapshot (#1604)
• ba94f95 Update @​github/copilot to 1.0.60 (#1597)
• 7d6bc92 Fix flaky SessionFs workspace metadata E2E test (#1599)
• 7de72a6 Update grep replay snapshot for absolute paths (#1598)
• f54e3ac Fix Go and Rust code generators (#1596)
• 9c4d637 Stop compiling Java in dependency update workflow (#1594)
• Additional commits viewable in compare view

Updates tsx from 4.22.3 to 4.22.4

Release notes

Sourced from tsx's releases.

v4.22.4

4.22.4 (2026-05-31)

Bug Fixes

• resolve CommonJS directory requires inside dependencies (#803) (1ce8463)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• 1ce8463 fix: resolve CommonJS directory requires inside dependencies (#803)
• See full diff in compare view

Updates @playwright/test from 1.60.0 to 1.61.0

Release notes

Sourced from @​playwright/test's releases.

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

• New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
• The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

• The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
• Supported expect.soft.poll(...).
• New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
• New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
• testInfo.errors now lists each sub-error of an AggregateError as a separate entry.

... (truncated)

Commits

• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• 8133dcf cherry-pick(#41283): docs: add Ubuntu 26.04 and Node.js 26.x to system requir...
• 812432e chore: mark v1.61.0 (#41277)
• ac05145 fix(fetch): report serverAddr and securityDetails for reused sockets (#41267)
• 056efc9 fix(trace-viewer): add keyboard navigation to NetworkFilters component (#41...
• 41f7b9a chore: fixes uncovered by the .NET 1.61 roll (#41266)
• ba50778 fix(mcp): assign caps as array for legacy --vision flag (#41253)
• b8ee5ae docs: release notes for v1.61 (#41261)
• 49c1f69 fix(trace viewer): load trace from a local file (#41263)
• Additional commits viewable in compare view

Updates eslint from 10.4.0 to 10.5.0

Release notes

Sourced from eslint's releases.

v10.5.0

Features

• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973) (Pixel998)
• b565783 feat: report no-with violations at the with keyword (#20971) (Pixel998)
• 2ce032f feat: report max-lines-per-function violations at function head (#20966) (Pixel998)
• 732cb3e feat: report max-nested-callbacks violations at function head (#20967) (Pixel998)
• f9c138a feat: report max-depth violations on keywords (#20943) (Pixel998)
• bdb496c feat: correct max-depth handling for else-if chains (#20944) (Pixel998)
• c296873 feat: update error loc in max-statements to function header (#20907) (Taejin Kim)

Documentation

• 8ae1b5b docs: Update README (GitHub Actions Bot)
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962) (Francesco Trotta)
• f99b47a docs: Update README (GitHub Actions Bot)
• acf03d4 docs: clarify precedence of parserOptions over languageOptions (#20926) (sethamus)

Chores

• b18bf58 chore: update ecosystem plugins (#20959) (ESLint Bot)
• c2d1444 refactor: replace areAllSegmentsUnreachable with !isAnySegmentReachable (#20951) (Taejin Kim)
• 243b8c5 chore: enhance config-rule to support oneOf, anyOf, and nested schemas (#20788) (kuldeep kumar)
• 217b2a9 test: add unit tests for ParserService (#20949) (Taejin Kim)
• 72003e7 test: add location information to error messages in max-statements (#20945) (lumir)
• 7797c26 refactor: deduplicate isAnySegmentReachable across rules (#20890) (Taejin Kim)
• 67c46fa chore: update ecosystem plugins (#20938) (ESLint Bot)
• 95d8c7a chore: update dependency @​eslint/json to v2 (#20934) (renovate[bot])
• cf9e496 chore: update @​arethetypeswrong/cli to 0.18.3 (#20933) (Pixel998)
• fb6d396 test: run type tests with TypeScript 7 (#20868) (sethamus)

v10.4.1

Bug Fixes

• e557467 fix: update @eslint/plugin-kit version to 0.7.2 (#20930) (Francesco Trotta)
• d4ce898 fix: propagate failures from delegated commands (#20917) (Minh Vu)
• f4f3507 fix: prefer-arrow-callback invalid autofix with newline after async (#20916) (kuldeep kumar)
• c5bc78b fix: false positive for reference in finally block (#20655) (Tanuj Kanti)
• 27538c0 fix: add missing CodePath and CodePathSegment types (#20853) (Pixel998)

Documentation

• 61b0add docs: remove deprecated rule from related rules of max-params (#20921) (Tanuj Kanti)
• 305d5b9 docs: remove deprecated rules from related rules section (#20911) (Tanuj Kanti)
• 49b0202 docs: fix display: none of ad (#20901) (Tanuj Kanti)
• 9067f94 docs: switch build to Node.js 24 (#20893) (Milos Djermanovic)
• c91b041 docs: Update README (GitHub Actions Bot)
• e349265 docs: clarify semver strings in rule deprecation objects (#20885) (Milos Djermanovic)

Chores

• b0e466b test: add data property to invalid tests cases for rules (#20924) (Tanuj Kanti)
• f78838b test: add CodePath type coverage (#20904) (Pixel998)
• 1daa4bd chore: update eslint-plugin-eslint-comments test data to latest commit (#20922) (Francesco Trotta)
• 002942c ci: declare contents:read on update-readme workflow (#20919) (Arpit Jain)
• 64bca24 chore: update ecosystem plugins (#20912) (ESLint Bot)

... (truncated)

Commits

• de3b672 10.5.0
• 362a518 Build: changelog update for 10.5.0
• 5ca8c52 feat: correct stack tracking in max-nested-callbacks (#20973)
• b565783 feat: report no-with violations at the with keyword (#20971)
• 2ce032f feat: report max-lines-per-function violations at function head (#20966)
• 732cb3e feat: report max-nested-callbacks violations at function head (#20967)
• f9c138a feat: report max-depth violations on keywords (#20943)
• 8ae1b5b docs: Update README
• ca7eb90 docs: update Node.js prerequisites to include ICU support (#20962)
• b18bf58 chore: update ecosystem plugins (#20959)
• Additional commits viewable in compare view

Updates eslint-plugin-security from 4.0.0 to 4.0.1

Release notes

Sourced from eslint-plugin-security's releases.

eslint-plugin-security: v4.0.1

4.0.1 (2026-06-12)

Bug Fixes

• treat import.meta.dirname and import.meta.filename as static (#200) (74c97bb)

Changelog

Sourced from eslint-plugin-security's changelog.

4.0.1 (2026-06-12)

Bug Fixes

• treat import.meta.dirname and import.meta.filename as static (#200) (74c97bb)

Commits

• cb8645c chore: release 4.0.1 🚀 (#204)
• 74c97bb fix: treat import.meta.dirname and import.meta.filename as static (#200)
• 0b45f82 chore(deps-dev): bump shell-quote from 1.7.4 to 1.8.4 (#202)
• 954149a chore(deps-dev): bump handlebars from 4.7.7 to 4.7.9 (#198)
• d5012b6 chore(deps-dev): bump picomatch from 2.3.1 to 2.3.2 (#197)
• b53d8b4 chore(deps-dev): bump flatted from 3.3.1 to 3.4.2 (#196)
• 7876750 chore(deps): bump minimatch (#194)
• See full diff in compare view

Updates lint-staged from 17.0.5 to 17.0.7

Release notes

Sourced from lint-staged's releases.

v17.0.7

Patch Changes

• #1806 e692e58 - Update dependency tinyexec@^1.2.4.

v17.0.6

Patch Changes

• #1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

• #1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

• #1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

• #1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

Changelog

Sourced from lint-staged's changelog.

17.0.7

Patch Changes

• #1806 e692e58 - Update dependency tinyexec@^1.2.4.

17.0.6

Patch Changes

• #1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

• #1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

• #1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

• #1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

Commits

• cd11fec Merge pull request #1807 from lint-staged/changeset-release/main
• 15a8ee0 chore(changeset): release
• 797bbd9 Merge pull request #1808 from lint-staged/add-stashing-faq
• 504e307 docs: add FAQ entry on how stashing works
• eff5cd1 Merge pull request #1806 from lint-staged/update-tinyexec
• e692e58 build(deps): update tinyexec@^1.2.4
• a2dd4ea Merge pull request #1805 from lint-staged/update-github-templates
• c928519 docs: update GitHub templates
• 094ba56 Merge pull request #1798 from lint-staged/changeset-release/main
• 88e19fe chore(changeset): release
• Additional commits viewable in compare view

Updates prettier from 3.8.3 to 3.8.4

Release notes

Sourced from prettier's releases.

3.8.4

• Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (prettier/prettier#17746 by @​byplayer)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.8.4

diff

Markdown: Fix blank lines between list items and nested sub-lists being removed in Markdown/MDX (#17746 by @​byplayer)

Prettier was removing blank lines between list items and their nested sub-lists, converting loose lists into tight lists and changing their semantic meaning.

<!-- Input -->
- a


b


c

d



<!-- Prettier 3.8.3 -->

a

b


c

d



<!-- Prettier 3.8.4 -->


a

b



c

d

Commits

• 1c6ba55 Release 3.8.4
• 4a673dc Fix blank lines between list items and nested sub-lists being removed in Mark...
• 074aaed Replace main branch in changelog link with tags (#19054)
• c22a003 Bump Prettier dependency to 3.8.3
• 07bad1f Clean changelog_unreleased
• See full diff in compare view

Updates better-sqlite3 from 12.10.0 to 12.10.1

Release notes

Sourced from better-sqlite3's releases.

v12.10.1

What's Changed

• Bump the github-actions group across 1 directory with 4 updates by @​dependabot[bot] in WiseLibs/better-sqlite3#1451
• Fix V8 external API usage for Electron 42 by @​tstone-1 in WiseLibs/better-sqlite3#1475

Full Changelog: WiseLibs/better-sqlite3@v12.10.0...v12.10.1

Commits

• da6152c 12.10.1
• 5bb63a2 Fix V8 external API usage for Electron 42 (#1475)
• ca60e36 Bump the github-actions group across 1 directory with 4 updates (#1451)
• f93f490 Update SQLite to version 3.53.2 (#1483)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

Coverage Report

Status	Category	Percentage	Covered / Total
🔵	Lines	93.4%	8552 / 9156
🔵	Statements	93.4%	8552 / 9156
🔵	Functions	94.04%	221 / 235
🔵	Branches	87.92%	2177 / 2476

File Coverage

File	Stmts	Branches	Functions	Lines	Uncovered Lines
Unchanged Files
bin/termbeam.js	61.62%	76.31%	50%	61.62%	40-63, 82-83, 89-117, 128, 142-146, 150-151, 155-157
src/cli/client.js	100%	97.67%	88.88%	100%
src/cli/index.js	94.97%	89.51%	100%	94.97%	132-135, 214-216, 218-220, 307-309, 327-329, 335, 353-356
src/cli/interactive.js	100%	98.21%	100%	100%
src/cli/prompts.js	94.52%	94.82%	100%	94.52%	73-74, 92-95, 101-102
src/cli/resume.js	99.04%	92.61%	88.88%	99.04%	42-43, 416, 419
src/cli/service.js	91.03%	84.97%	100%	91.03%	455-480, 498-499, 503-505, 507-512, 523-531, 540-546, 568-569, 642-655
src/server/auth.js	100%	96.87%	100%	100%
src/server/copilot-sdk.js	96.92%	93.78%	100%	96.92%	35-36, 52-59, 73-75, 89-90, 112-113, 203, 308
src/server/index.js	84.29%	81.73%	87.5%	84.29%	115-116, 251, 253, 258, 260-261, 263-264, 271-272, 275-277, 291-293, 296-323, 369-370, 373, 404-406, 414-415, 457-463, 512-535
src/server/preferences.js	95.42%	81.9%	100%	95.42%	97, 99-100, 105, 107-108, 245-246, 248-250, 269-270
src/server/preview.js	95.68%	90%	100%	95.68%	93-97
src/server/push.js	100%	92.85%	100%	100%
src/server/routes.js	89.64%	80.98%	70.58%	89.64%	33-34, 46-47, 68-70, 73-74, 130-132, 186-203, 275-286, 291-332, 347, 507-508, 529-530, 591-593, 605-607, 746-747, 807, 809-810, 856-857, 864-865, 893-894, 908-909, 955-956, 958-959, 1004-1005, 1024-1025, 1043-1045, 1095-1096, 1170-1172, 1201-1203, 1219-1221, 1241-1243, 1333-1334, 1340-1343, 1374-1375, 1396-1398, 1447-1448, 1463-1464, 1488-1489, 1517-1519, 1527-1529, 1544-1545, 1550-1551, 1559-1560, 1580-1581, 1597-1598
src/server/sessions.js	93.32%	90.24%	86.66%	93.32%	10-24, 65-71, 78-79, 182-184, 256-258, 275-276, 432-435
src/server/websocket.js	96.11%	91.95%	100%	96.11%	249, 302, 404-409, 428-429, 431-432, 439-440, 460-461, 464-465, 472-473
src/utils/agent-sessions.js	93.4%	81.92%	100%	93.4%	73-74, 130-138, 163-164, 172-174, 186-187, 278
src/utils/agents.js	100%	83.33%	100%	100%
src/utils/git.js	94.43%	91.13%	100%	94.43%	24, 30-31, 41-48, 63-64, 250-251, 368-380
src/utils/logger.js	100%	100%	100%	100%
src/utils/shells.js	100%	100%	100%	100%
src/utils/update-check.js	91.05%	84.05%	93.33%	91.05%	202-204, 341-355, 370-383, 399-402, 420-423
src/utils/update-executor.js	98.92%	95.06%	100%	98.92%	316-317, 334-335
src/utils/vapid.js	100%	100%	100%	100%
src/utils/version.js	97.77%	92.3%	100%	97.77%	86-87

Generated in workflow #902 for commit 5a1c9e0 by the Vitest Coverage Report Action

[dorlugasigal]

Superseded by #254, which combined these updates (actions + npm + Docker) plus an astro/vite security fix and merged to main. Closing as resolved.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml