fix(deps): update all dependencies

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
@convex-dev/resend	^0.2.3 → ^0.2.4
@convex-dev/workos (source)	^0.0.1 → ^0.0.2
@convex-dev/workos-authkit	^0.2.4 → ^0.2.5
@opentelemetry/exporter-logs-otlp-http (source)	^0.217.0 → ^0.218.0
@opentelemetry/exporter-metrics-otlp-proto (source)	^0.217.0 → ^0.218.0
@opentelemetry/exporter-trace-otlp-http (source)	^0.217.0 → ^0.218.0
@opentelemetry/exporter-trace-otlp-proto (source)	^0.217.0 → ^0.218.0
@opentelemetry/sdk-node (source)	^0.217.0 → ^0.218.0
@opentelemetry/semantic-conventions (source)	^1.40.0 → ^1.41.1
@playwright/test (source)	^1.59.1 → ^1.60.0
@types/node (source)	^25.6.2 → ^25.8.0
@vitejs/plugin-react (source)	^6.0.1 → ^6.0.2
@workos-inc/authkit-nextjs	^4.0.1 → ^4.1.0
bun-types (source)	^1.3.13 → ^1.3.14
convex (source)	^1.38.0 → ^1.39.1
convex-helpers (source)	^0.1.116 → ^0.1.118
convex-test (source)	^0.0.51 → ^0.0.52
lucide-react (source)	^1.14.0 → ^1.16.0
next-intl (source)	^4.11.1 → ^4.12.0
react-hook-form (source)	^7.75.0 → ^7.76.0
vitest (source)	^4.1.5 → ^4.1.6

---

Release Notes

get-convex/resend (@​convex-dev/resend)

v0.2.4

Compare Source

• Fixed an issue in resend.sendEmailManually where the cc and bcc fields
  would not be persisted to the database (thanks @​zxt-tzx!)

get-convex/workos-authkit (@​convex-dev/workos-authkit)

v0.2.5

Compare Source

• fix: skip unknown events (#​56)
• feat: support custom auth api domain (#​52)

open-telemetry/opentelemetry-js (@​opentelemetry/exporter-logs-otlp-http)

v0.218.0

Compare Source

microsoft/playwright (@​playwright/test)

v1.60.0

Compare Source

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:

await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.

🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:

await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});

await page.locator('#dropzone').drop({
  data: {
    'text/plain': 'hello world',
    'text/uri-list': 'https://example.com',
  },
});

🎯 Aria snapshots

• expect(page).toMatchAriaSnapshot() now works on a Page, in addition to a Locator — equivalent to asserting against page.locator('body').
• New boxes option on locator.ariaSnapshot() / page.ariaSnapshot() appends each element's bounding box as [box=x,y,width,height], useful for AI consumption.

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:

test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});

New APIs

Browser, Context and Page

• Event browser.on('context') — fired when a new context is created on the browser.
• BrowserContext now mirrors lifecycle events from its pages: browserContext.on('download'), browserContext.on('frameattached'), browserContext.on('framedetached'), browserContext.on('framenavigated'), browserContext.on('pageclose'), browserContext.on('pageload').

Locators and Assertions

• New option description in page.getByRole() / locator.getByRole() / frame.getByRole() / frameLocator.getByRole() for matching the accessible description.
• New option pseudo in expect(locator).toHaveCSS() reads computed styles from ::before or ::after.
• New option style in locator.highlight() applies extra inline CSS to the highlight overlay, plus new page.hideHighlight() to clear all highlights.

Network

• webSocketRoute.protocols() returns the WebSocket subprotocols requested by the page.
• New option noDefaults in browserType.connectOverCDP() disables Playwright's default overrides on the default context (download behavior, focus emulation, media emulation), so attaching to a user's daily-driver browser doesn't disturb its state.

Errors and Reporting

• New webError.location() mirrors consoleMessage.location().
• consoleMessage.location() now exposes line / column properties (lineNumber / columnNumber are deprecated).
• New testInfoError.errorContext surfaces additional diagnostic context, such as the aria snapshot of the receiver at the time of an expect(...) matcher failure.
• reporter.onError() now receives a workerInfo argument with details about the worker for fixture teardown errors.

Test runner

• New {testFileBaseName} token in testProject.snapshotPathTemplate — file name without extension.
• Test runner now errors when a config tries to override a non-option fixture, and rejects workers: 0 or negative values.

🛠️ Other improvements

• HTML reporter:
  • npx playwright show-report accepts .zip files directly — no need to unzip first.
  • Steps that contain attachments inside nested children show an indicator on the parent step.
  • The repeatEachIndex is shown in the test header when non-zero.
• Trace Viewer adds a pretty-print toggle for JSON / form request and response bodies in the network details panel.

Breaking Changes ⚠️

• Removed long-deprecated APIs:
  • Locator.ariaRef() — use the standard locator.ariaSnapshot() pipeline.
  • handle option on BrowserContext.exposeBinding and Page.exposeBinding.
  • logger option on BrowserType.connect and BrowserType.connectOverCDP — use tracing instead.
  • Context options videosPath / videoSize — use recordVideo instead.

Browser Versions

• Chromium 148.0.7778.96
• Mozilla Firefox 150.0.2
• WebKit 26.4

This version was also tested against the following stable channels:

• Google Chrome 147
• Microsoft Edge 147

vitejs/vite-plugin-react (@​vitejs/plugin-react)

v6.0.2

Compare Source

Allow all options in reactCompilerPreset (#​1189)

This is a type only change. Only compilationMode and target options were available for reactCompilerPreset.

workos/authkit-nextjs (@​workos-inc/authkit-nextjs)

v4.1.0

Compare Source

Features

• Add feature flags runtime client helper (#​428) (be6b932)

oven-sh/bun (bun-types)

v1.3.14

Compare Source

get-convex/convex-backend (convex)

v1.39.1

• Fixes package.json bin entrypoint bug in 1.39.0.

v1.39.0

• Apps and components may now declare typesafe env vars that they require. Both defineApp
  and defineComponent now accept an env object with string keys and validator values.
  Declared environment variables must be present and match the validators before deployment.
• Allow --local-cloud-port, --local-site-port, --local-backend-version and
  --local-force-upgrade options to npx convex dev to be used whenever using a local deployment.
• The AsyncLocalStorage and AsyncResource APIs from node:async_hooks are now available
  in the standard Convex runtime. Note that stored values will not be threaded through calls to
  ctx.runQuery/ctx.runMutation/ctx.runAction.

get-convex/convex-helpers (convex-helpers)

v0.1.118

Compare Source

• Fixes the helpers custom pagination page splitting logic when used
  with filters. Previously it would aggressively split pages whenever
  more items were scanned than requested. Now it only splits when
  the page grows to be larger than the number of requested items or
  so many documents are being scanned that the limits are close to being
  hit.

v0.1.117

Compare Source

• Zod 4 support: fixed an issue with the return type of convexToZod
  when the input type is a non-tuple array type.

get-convex/convex-test (convex-test)

v0.0.52

Compare Source

• Add implementation for ctx.meta.getDeploymentMetadata().
• Add support for internal audit log syscall.

lucide-icons/lucide (lucide-react)

v1.16.0: Version 1.16.0

Compare Source

What's Changed

• feat(icons): added blender icon by @​rrod497 in #​3884

Full Changelog: lucide-icons/lucide@1.15.0...1.16.0

v1.15.0

Compare Source

amannn/next-intl (next-intl)

v4.12.0

Compare Source

Features

• Improvements for useExtracted (#​2316) (bff2f96) – by @​amannn

v4.11.2

Compare Source

Bug Fixes

• Revert x-forwarded-host redirect domain change (#​2322) (eb3a6a4) – by @​amannn

react-hook-form/react-hook-form (react-hook-form)

v7.76.0

Compare Source

vitest-dev/vitest (vitest)

v4.1.6

Compare Source

   🐞 Bug Fixes

• browser: Provide project reference in ToMatchScreenshotResolvePath  -  by @​macarie and @​sheremet-va in #​10138 (31882)
• Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options  -  by @​hi-ogawa, Codex and @​sheremet-va in #​10196 (2847d)
• browser: Simplify orchestrator otel carrier  -  by @​hi-ogawa in #​10285 (18af9)

   🏎 Performance

• Stringify diff objects only once  -  by @​sheremet-va in #​10276 (9f7b1)

    View changes on GitHub

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
blueprint	Ready	Preview, Comment	May 16, 2026 1:07am