chore(deps): bump the minor-and-patch group across 1 directory with 28 updates

[dependabot]

Bumps the minor-and-patch group with 27 updates in the / directory:

Package	From	To
@fortawesome/fontawesome-svg-core	7.2.0	7.3.0
@fortawesome/free-brands-svg-icons	7.2.0	7.3.0
@fortawesome/free-solid-svg-icons	7.2.0	7.3.0
@radix-ui/react-dialog	1.1.15	1.1.17
@radix-ui/react-dropdown-menu	2.1.16	2.1.18
@radix-ui/react-popover	1.1.15	1.1.17
@radix-ui/react-toggle-group	1.1.11	1.1.13
@radix-ui/react-tooltip	1.2.8	1.2.10
@simplewebauthn/server	13.3.0	13.3.2
framer-motion	12.38.0	12.42.0
next	16.2.6	16.2.9
next-intl	4.11.1	4.13.0
otplib	13.4.0	13.4.1
pg	8.20.0	8.22.0
react	19.2.6	19.2.7
@types/react	19.2.14	19.2.17
react-dom	19.2.6	19.2.7
sharp	0.34.5	0.35.2
swagger-ui-react	5.32.5	5.32.8
@playwright/test	1.59.1	1.61.1
@tailwindcss/postcss	4.2.4	4.3.2
@types/node	25.6.0	25.9.4
@vitest/coverage-v8	4.1.5	4.1.9
@vitest/ui	4.1.5	4.1.9
eslint-config-next	16.2.6	16.2.9
npm-check-updates	22.1.1	22.2.9
vitest	4.1.5	4.1.9

Updates @fortawesome/fontawesome-svg-core from 7.2.0 to 7.3.0

Release notes

Sourced from @​fortawesome/fontawesome-svg-core's releases.

Release 7.3.0

Change log available at https://fontawesome.com/docs/changelog/

Commits

• 70fb2dd Release 7.3.0 (#21612)
• See full diff in compare view

Updates @fortawesome/free-brands-svg-icons from 7.2.0 to 7.3.0

Release notes

Sourced from @​fortawesome/free-brands-svg-icons's releases.

Release 7.3.0

Change log available at https://fontawesome.com/docs/changelog/

Commits

• 70fb2dd Release 7.3.0 (#21612)
• See full diff in compare view

Updates @fortawesome/free-solid-svg-icons from 7.2.0 to 7.3.0

Release notes

Sourced from @​fortawesome/free-solid-svg-icons's releases.

Release 7.3.0

Change log available at https://fontawesome.com/docs/changelog/

Commits

• 70fb2dd Release 7.3.0 (#21612)
• See full diff in compare view

Updates @radix-ui/react-dialog from 1.1.15 to 1.1.17

Changelog

Sourced from @​radix-ui/react-dialog's changelog.

1.1.17

• Removed dev-only warnings for dialogs when title and/or description is not rendered.
• Fixed Dismissable Layer so outside interactions stopped by extension UI overlays do not dismiss dialogs or popovers.
• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-focus-scope@1.1.10, @radix-ui/react-portal@1.1.12

1.1.16

• Fixed disabled pointer events in closed dialogs
• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dialog since your current version.

Updates @radix-ui/react-dropdown-menu from 2.1.16 to 2.1.18

Changelog

Sourced from @​radix-ui/react-dropdown-menu's changelog.

2.1.18

• Fixed a bug where menus and submenus remained open after a window loses focus.
• Updated dependencies: @radix-ui/react-menu@2.1.18, @radix-ui/react-primitive@2.1.6

2.1.17

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-menu@2.1.17, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-dropdown-menu since your current version.

Updates @radix-ui/react-popover from 1.1.15 to 1.1.17

Changelog

Sourced from @​radix-ui/react-popover's changelog.

1.1.17

• Fixed Dismissable Layer so outside interactions stopped by extension UI overlays do not dismiss dialogs or popovers.
• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-focus-scope@1.1.10, @radix-ui/react-portal@1.1.12

1.1.16

• Fixed a bug where iOS text selection and editing on HTML inputs within react-dialog were broken
• Fixed triggers referencing a non-existent element via aria-controls when their content is removed from the DOM (credit to @​dodomorandi for the original PR)
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-focus-guards@1.1.4, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-focus-scope@1.1.9, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-popover since your current version.

Updates @radix-ui/react-toggle-group from 1.1.11 to 1.1.13

Changelog

Sourced from @​radix-ui/react-toggle-group's changelog.

1.1.13

• Updated single-select and multi-select toggle groups to use the radiogroup and toolbar roles, respectively.
• Updated dependencies: @radix-ui/react-primitive@2.1.6, @radix-ui/react-roving-focus@1.1.13, @radix-ui/react-toggle@1.1.12

1.1.12

• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-direction@1.1.2, @radix-ui/primitive@1.1.4, @radix-ui/react-context@1.1.4, @radix-ui/react-primitive@2.1.5, @radix-ui/react-roving-focus@1.1.12, @radix-ui/react-toggle@1.1.11, @radix-ui/react-use-controllable-state@1.2.3

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-toggle-group since your current version.

Updates @radix-ui/react-tooltip from 1.2.8 to 1.2.10

Changelog

Sourced from @​radix-ui/react-tooltip's changelog.

1.2.10

• Updated dependencies: @radix-ui/react-slot@1.3.0, @radix-ui/react-popper@1.3.1, @radix-ui/react-dismissable-layer@1.1.13, @radix-ui/react-primitive@2.1.6, @radix-ui/react-portal@1.1.12, @radix-ui/react-visually-hidden@1.2.6

1.2.9

• Fixed runtime error when event target is non-Node
• Fixed a Tooltip bug so that skipDelayDuration={0} works as expected. Previously, the open delay could still be skipped when moving between triggers.
• Added repository.directory to all package.json files
• Updated dependencies: @radix-ui/react-presence@1.1.6, @radix-ui/react-popper@1.3.0, @radix-ui/react-slot@1.2.5, @radix-ui/react-dismissable-layer@1.1.12, @radix-ui/primitive@1.1.4, @radix-ui/react-compose-refs@1.1.3, @radix-ui/react-context@1.1.4, @radix-ui/react-id@1.1.2, @radix-ui/react-portal@1.1.11, @radix-ui/react-primitive@2.1.5, @radix-ui/react-use-controllable-state@1.2.3, @radix-ui/react-visually-hidden@1.2.5

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-tooltip since your current version.

Updates @simplewebauthn/server from 13.3.0 to 13.3.2

Release notes

Sourced from @​simplewebauthn/server's releases.

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

• [server] Fixed an issue with verifyRegistrationResponse() failing to verify some Packed and SafetyNet statements (#767)

Changelog

Sourced from @​simplewebauthn/server's changelog.

v13.3.2

This update fixes a CVSS v4 Low (2.0) security vulnerability identified in @​simplewebauthn/server. See the security advisory linked below for more information.

Changes:

• [server] Fixed an issue with verifyRegistrationResponse() allowing a maliciously-crafted attestation statement's x5c to contain a self-signed "root certificate" instead of chaining back to an RP-specified trust anchor (GHSA-6hxq-p678-4hr2)

v13.3.1

Changes:

• [server] Fixed an issue with verifyRegistrationResponse() failing to verify some Packed and SafetyNet statements (#767)

Commits

• 84656ff Update version to 13.3.2
• dd0d73c Fail cert path validation closed instead
• 213e9ba Add test for failure to chain to trust anchor
• 989507a Add tests for notAfter enforcement
• b55f4b9 Move explanation into test
• 7bed04c Update comments around cert chain validity
• 6ee9644 Add new tests
• c23890a Update existing test to use helpers
• 8d02ed4 Add X.509 cert helpers for tests
• 8a53d70 Use X509ChainBuilder for chain validation
• Additional commits viewable in compare view

Updates framer-motion from 12.38.0 to 12.42.0

Changelog

Sourced from framer-motion's changelog.

[12.42.0] 2026-06-24

Changed

• animateView: Layers are automatically grouped to match their DOM-hierarchy. New .group(false) method opts-out.

Fixed

• animateView: Auto-crop is now aspect-ratio aware, disabling crops for matching aspect-ratios.
• animateView: Disabled automatic border-radius animation.

[12.41.0] 2026-06-23

Added

• animateView: Moves from Motion+ Early Access and alpha to main library.
• animateView: .add() resolves a CSS selector or Element to automatically generate, apply and remove view-transition-name.
• animateView: .new() and .old() configures values to animate on new and old layers.
• animateView: .layout() can set a custom transition on the size/position animation of the currently selected elements.
• animateView: Group layers now automatically crop with children set to cover, with border-radius animating from old radius to new. .crop(false) disables this behaviour.
• animateView: .class(name) tags currently selected elements with a view-transition-class as a custom CSS hook.

Fixed

• AnimatePresence: Prevent stuck exit animations when children interrupt.
• drag: Child e.stopPropagation() no longer break drag end.
• Fixing Next.js OOM on Windows when importing via motion package.
• animateLayout: Improve handling of parallel/interleaved calls.

Changed

• animateView: .enter() and .exit() now refer specifically to new and old layers where there are no matching old or new layers.
• animateView: Interrupted transition setups now return resolved animation rather than throwing.

[12.40.0] 2026-05-21

Added

• path option to transition.
• arc() for motion along an arc.

[12.39.0] 2026-05-18

Added

• Support for repeatType and repeatDelay in animation sequences.

Fixed

• Variants: Re-run keyframe animations when switching between variant labels even when they share identical keyframe arrays.

... (truncated)

Commits

• 9c84145 v12.42.0
• 60d7c72 Add view-transition group nesting and aspect-aware cropping
• 6437276 Updating
• f0f893e v12.41.0
• c0c53cb Updating changelog
• 18c3e3e Removing plans
• 378fc4c Merge pull request #3761 from motiondivision/worktree-view-target
• 94ea505 Merge branch 'main' into worktree-view-target
• de65f6b Fade auto morph crossfades over the spring's visual duration
• f8af239 Let an explicit duration override the inherited spring on a view layer
• Additional commits viewable in compare view

Updates next from 16.2.6 to 16.2.9

Release notes

Sourced from next's releases.

v16.2.9

Empty release to ensure next@latest points at a stable release. Next.js only allows publishing with Trusted Publishing enabled. In order to fix NPM dist-tags, we have to release a new version. Updating dist-tags is not possible with Trusted Publishing.

v16.2.8

Release with no changes in an attempt to fix next@latest pointing at a prerelease version.

v16.2.7

[!NOTE] This release is backporting bug fixes. It does not include all pending features/changes on canary.

Core Changes

• Backport documentation fixes for v16.2 (#93804)
• [backport] Patch playwright-core to resolve _finishedPromise on requestFailed (#93920)
• [backport] Fix dev mode hydration failure when page is served from HTTP cache (#93492)
• [backport] Fix catch-all router.query corruption with basePath + rewrites (#93917)
• [backport] Encode non-ASCII characters in cache tags at construction (#93918)
• [backport] Fix server action forwarding loop with middleware rewrites (#93919)
• [backport] Turbopack: switch from base40 to base38 hash encoding (#93932)
• [ci] Disable hanging node 24 typescript tests on 16.2 backport branch (#94164)
• [backport] Fix "type: module" in project dir when using standalone or adapters (#94050)
• [backport] Propagate adapter preferred regions (#94200)
• [16.2.x] Don't drop FormData entries (#94240)
• [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolution (#94284)

Credits

Huge thanks to @​eps1lon, @​icyJoseph, @​unstubbable, @​mischnic, @​bgw, @​timneutkens, and @​lukesandberg for helping!

Commits

• f37fad9 v16.2.9
• d9aaaed [cd] Allow tagging semver-lower releases as @latest if @latest po… (#94627)
• 6f16804 v16.2.8
• 0dbc1d5 [16.2.x][cd] Ensure release can be triggered on old branches (#94598)
• 90e3c81 [16.2.x] Align Actions dependencies with Canary (#94339)
• 83f402c [16.2.x][cd] Stop fetching all tags when searching parent tag (#94334)
• 411c455 v16.2.7
• c63224f [backport] feat(turbopack): add LocalPathOrProjectPath PostCSS config resolut...
• 63115c7 [16.2.x] Don't drop FormData entries (#94240)
• aef22fd [backport] Propagate adapter preferred regions (#94200)
• Additional commits viewable in compare view

Updates next-intl from 4.11.1 to 4.13.0

Release notes

Sourced from next-intl's releases.

v4.13.0

4.13.0 (2026-05-28)

Features

• Use URL-safe base64 for auto-generated message keys of useExtracted (#2330) (a003d3a) – by @​spokodev

⚠️ If you're using useExtracted, this requires an update to your existing keys. Please point your agent at amannn/next-intl#2330 to upgrade.

v4.12.0

4.12.0 (2026-05-13)

Features

• Improvements for useExtracted (#2316) (bff2f96) – by @​amannn

⚠️ A small config change is required for useExtracted users to upgrade, please see amannn/next-intl#2316 for details.

v4.11.2

4.11.2 (2026-05-11)

Bug Fixes

• Revert x-forwarded-host redirect domain change (#2322) (eb3a6a4) – by @​amannn

Changelog

Sourced from next-intl's changelog.

4.13.0 (2026-05-28)

Features

• Use URL-safe base64 for auto-generated message keys of useExtracted (#2330) (a003d3a) – by @​spokodev

4.12.0 (2026-05-13)

Features

• Improvements for useExtracted (#2316) (bff2f96) – by @​amannn

4.11.2 (2026-05-11)

Bug Fixes

• Revert x-forwarded-host redirect domain change (#2322) (eb3a6a4) – by @​amannn

Commits

• 3e013c4 v4.13.0
• a003d3a feat: Use URL-safe base64 for auto-generated message keys of useExtracted (...
• 2e351ae docs: Add ElevenLabs logo
• d7aaa62 docs: Add note on Promise.all
• 233af94 docs: Reorder extraction docs
• d7bf7af v4.12.0
• bff2f96 feat: Improvements for useExtracted (#2316)
• 940dfbf v4.11.2
• eb3a6a4 fix: Revert x-forwarded-host redirect domain change (#2322)
• See full diff in compare view

Updates otplib from 13.4.0 to 13.4.1

Release notes

Sourced from otplib's releases.

v13.4.1

What's Changed

• fix: override flatted package security alert by @​yeojz in yeojz/otplib#820
• fix: override picomatch and yaml package security alerts by @​yeojz in yeojz/otplib#822
• refactor(testing): replace custom Deno adapter with @​std/expect by @​yeojz in yeojz/otplib#821
• fix: override brace-expansion package security alert by @​yeojz in yeojz/otplib#824
• chore: update github actions pinned images by @​yeojz in yeojz/otplib#823
• Add @​otplib/plugin-base32-alt to dependencies by @​yeojz in yeojz/otplib#825
• chore: harden supply chain with cooldown and version pinning by @​yeojz in yeojz/otplib#826
• refactor(testing): centralize test secrets into shared module by @​yeojz in yeojz/otplib#831
• chore(deps): bump the github-actions group with 5 updates by @​dependabot[bot] in yeojz/otplib#827
• refactor(testing): rename test secret constants for semantic clarity by @​yeojz in yeojz/otplib#832
• chore(deps-dev): bump the dev-dependencies-minor group with 4 updates by @​dependabot[bot] in yeojz/otplib#828
• refactor: replace size-limit with native bundle size check by @​yeojz in yeojz/otplib#835
• chore(deps-dev): bump vite from 7.3.1 to 8.0.0 by @​dependabot[bot] in yeojz/otplib#830
• refactor/docs/unusedImport by @​ValeriYanev98 in yeojz/otplib#837
• fix(security): address npm audit vulnerabilities by @​yeojz in yeojz/otplib#839
• fix(docker): bump pnpm to 10.30.1 to match packageManager by @​yeojz in yeojz/otplib#847
• docs: note short-secret guardrail override for legacy/test secrets by @​yeojz in yeojz/otplib#848
• docs(getting-started): clarify when each function runs by @​yeojz in yeojz/otplib#846
• chore(deps): bump vite from 5.4.21 to 8.0.10 by @​dependabot[bot] in yeojz/otplib#845
• chore(deps-dev): bump the dev-dependencies-patch group across 1 directory with 6 updates by @​dependabot[bot] in yeojz/otplib#849
• chore(deps-dev): bump the dev-dependencies-minor group across 1 directory with 6 updates by @​dependabot[bot] in yeojz/otplib#841
• docs(otplib): note 16-byte minimum and fix broken secret-handling link by @​yeojz in yeojz/otplib#851
• chore(deps-dev): bump @​codecov/bundle-analyzer from 1.9.1 to 2.0.1 by @​dependabot[bot] in yeojz/otplib#843
• fix(benchmarks): adapt to tinybench v6 TaskResult shape by @​yeojz in yeojz/otplib#852
• chore(deps): bump the github-actions group across 1 directory with 6 updates by @​dependabot[bot] in yeojz/otplib#844
• chore(deps): bump @​noble/hashes and @​scure/base to 2.2.0 by @​yeojz in yeojz/otplib#853
• chore(deps-dev): bump turbo from 2.9.9 to 2.9.14 by @​dependabot[bot] in yeojz/otplib#855
• ci: split security audit into blocking prod and informational full scans by @​yeojz in yeojz/otplib#857
• chore(deps-dev): bump vite from 8.0.10 to 8.0.11 by @​dependabot[bot] in yeojz/otplib#856
• release(packages): v13.4.1 by @​github-actions[bot] in yeojz/otplib#854

New Contributors

• @​ValeriYanev98 made their first contribution in yeojz/otplib#837

Full Changelog: yeojz/otplib@v13.4.0...v13.4.1

Commits

• 1d997b0 release(packages): v13.4.1 (#854)
• 0e9566f docs(otplib): note 16-byte minimum and fix broken secret-handling link (#851)
• e01b4f1 chore(deps-dev): bump the dev-dependencies-patch group across 1 directory wit...
• 212534b chore(deps-dev): bump the dev-dependencies-minor group with 4 updates (#828)
• b54adad refactor(testing): rename test secret constants for semantic clarity (#832)
• 4898252 refactor(testing): centralize test secrets and normalize naming (#831)
• See full diff in compare view

Updates pg from 8.20.0 to 8.22.0

Changelog

Sourced from pg's changelog.

pg@8.22.0

• Add support for sslnegotiation=direct for PostgreSQL 17+.

pg@8.21.0

• Handle SASL SCRAM server error responses properly.
• Add support for node@26.
• Add scramMaxIterations config option.
• Add client.getTransactionStatus() method.

Commits

• b617619 Publish
• d80b261 Update docs & changelog
• 835fb83 Fix error handling for exceptions on values parsing. (#3574)
• f49ab4a fix: correct spelling mistakes across codebase (#3692)
• d7175a4 Expand CI matrix of PG versions and add direct SSL test (#3693)
• 882fc30 Add support for sslnegotiation=direct (PostgreSQL 17) (#3688)
• 544b1ce Publish
• cc03fa5 Add scramMaxIterations option to limit SCRAM iteration count (#3677)
• f776327 Remove compatibility code for unsupported versions of Node (<16) (#3678)
• f252870 cleanup: pg utils (#3675)
• Additional commits viewable in compare view

Updates react from 19.2.6 to 19.2.7

Release notes

Sourced from react's releases.

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

Changelog

Sourced from react's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

Commits

• 6117d7c Version 19.2.7 (#36591)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react since your current version.

Updates @types/react from 19.2.14 to 19.2.17

Commits

• See full diff in compare view

Updates react-dom from 19.2.6 to 19.2.7

Release notes

Sourced from react-dom's releases.

19.2.7 (June 1st, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (#36566 by @​unstubbable)

Changelog

Sourced from react-dom's changelog.

19.2.7 (June 1, 2026)

React Server Components

• Fixed missing FormData entries in Server Actions which regressed in 19.2.6 (@​unstubbable #36566)

Commits

• 6117d7c Version 19.2.7 (#36591)
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for react-dom since your current version.

Updates sharp from 0.34.5 to 0.35.2

Release notes

Sourced from sharp's releases.

v0.35.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

• Bound dilate and erode width to avoid mask-size overflow. #4548 @​metsw24-max

• Verify convolve kernel values are numbers. #4549 @​metsw24-max

v0.35.2-rc.2

• TypeScript: Add mediaType to metadata response. #4492

• Improve WebAssembly fallback detection. #4513

• Improve code bundler support with stub binaries. #4543

• Verify GIF effort option is an integer. #4544 @​metsw24-max

• Verify recomb matrix entries are numbers. #4545 @​metsw24-max

• TypeScript: Replace namespace with named exports for ESM. #4546

... (truncated)

Commits

• c9622a3 Release v0.35.2
• cd4568f Upgrade to sharp-libvips v1.3.1
• 78390cf Tests: Add font file to prevent font discovery flakiness (#4550)
• 61210b4 Verify convolve kernel values are numbers (#4549)
• 1cb27dc Prerelease v0.35.2-rc.2
• c7606c3 Upgrade to sharp-libvips v1.3.1-rc.0
• 29d1e9e Prerelease v0.35.2-rc.1
• bbba0a1 Improve code bundler support with stub binaries
• ab52866 Bound dilate and erode width to avoid mask-size overflow (#4548)
• 0f594dd Prerelease v0.35.2-rc.0
• Additional commits viewable in compare view

Updates swagger-ui-react from 5.32.5 to 5.32.8

Release notes

Sourced from swagger-ui-react's releases.

v5.32.8

5.32.8 (2026-06-23)

Bug Fixes

• avoid filling parameter input with invalid array initial values (#10928) (014c512)

v5.32.7

5.32.7 (2026-06-22)

Bug Fixes

• deps: bump dompurify from 3.4.0 to 3.4.9 (#10923) (15fc7d1)
• deps: bump dompurify from 3.4.9 to 3.4.11 (#10931) (52ef1c9)
• deps: bump form-data from 4.0.5 to 4.0.6 (#10924) (f8bcbbf)
• deps: bump http-proxy-middleware to 2.0.10 and ws to 8.21.0 (#10935) (dd0d338)
• deps: bump js-yaml from 4.1.1 to 4.2.0 (#10927) (bf17869)
• deps: bump launch-editor from 2.10.0 to 2.14.1 (#10926) (9b6b6ff)

v5.32.6

5.32.6 (2026-05-12)

Bug Fixes

• deps-dev: address undici vulnerability (#10870) (35f5a6a)
• docker: address CVE-2026-27135 nghttp2-libs vulnerability (#10879) (0a63415)

Commits

• 4e0d3f8 chore(release): cut the 5.32.8 release
• b1990bf chore(deps): bump nginx from 1.31.0-alpine to 1.31.2-alpine (#10936)
• 014c512 fix: avoid filling parameter input with invalid array initial values (#10928)
• bf6a8f0 chore(release): cut the 5.32.7 release
• dd0d338 fix(deps): bump http-proxy-middleware to 2.0.10 and ws to 8.21.0 (#10935)
• 6287405 chore(deps): bump actions/checkout from 6 to 7 (#10933)
• 52ef1c9 fix(deps): bump dompurify from 3.4.9 to 3.4.11 (#10931)
• 4d21bfb chore(deps-dev): bump webpack-dev-server from 5.2.4 to 5.2.5 (#10930)
• fb2c061 chore(deps-dev): bump @​babel/core from 7.26.10 to 7.29.6 (#10925)
• f8bcbbf fix(deps): bump form-data from 4.0.5 to 4.0.6 (#10924)
• Additional commits viewable in compare view

Updates @playwright/test from 1.59.1 to 1.61.1

Release notes

Sourced from @​playwright/test's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

Description has been truncated

[dependabot]

Labels

The following labels could not be found: security. Please create it before Dependabot can add it to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.