Chore(deps): Bump the npm-all group across 1 directory with 12 updates

[dependabot]

Bumps the npm-all group with 12 updates in the /src/frontend directory:

Package	From	To
@astrojs/markdown-remark	7.2.1	7.2.2
@astrojs/mdx	7.0.3	7.0.5
@astrojs/starlight	0.41.3	0.41.6
astro	7.1.3	7.1.6
satori	0.28.1	0.29.0
@iconify-json/material-icon-theme	1.2.69	1.2.70
@playwright/test	1.61.1	1.62.1
astro-vtbot	3.0.0	3.0.1
eslint	10.7.0	10.8.0
globals	17.7.0	17.8.0
prettier	3.9.5	3.9.6
typescript	6.0.3	7.0.2

Updates @astrojs/markdown-remark from 7.2.1 to 7.2.2

Release notes

Sourced from @​astrojs/markdown-remark's releases.

@​astrojs/markdown-remark@​7.2.2

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2

Changelog

Sourced from @​astrojs/markdown-remark's changelog.

7.2.2

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2

Commits

• b0535ca [ci] release (#17528)
• See full diff in compare view

Updates @astrojs/mdx from 7.0.3 to 7.0.5

Release notes

Sourced from @​astrojs/mdx's releases.

@​astrojs/mdx@​7.0.5

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2
  • @​astrojs/markdown-remark@​7.2.2

@​astrojs/mdx@​7.0.4

Patch Changes

• #17514 41a00dd Thanks @​gtritchie! - Fixes a bug where the integration was emitting React-cased attribute names.

Changelog

Sourced from @​astrojs/mdx's changelog.

7.0.5

Patch Changes

• Updated dependencies [c895b12]:
  • @​astrojs/internal-helpers@​0.10.2
  • @​astrojs/markdown-remark@​7.2.2

7.0.4

Patch Changes

• #17514 41a00dd Thanks @​gtritchie! - Fixes a bug where the integration was emitting React-cased attribute names.

Commits

• b0535ca [ci] release (#17528)
• 112d3ea [ci] release (#17469)
• 41a00dd fix(mdx): emit HTML attribute casing on the Sätteri MDX path (#17514)
• See full diff in compare view

Updates @astrojs/starlight from 0.41.3 to 0.41.6

Release notes

Sourced from @​astrojs/starlight's releases.

@​astrojs/starlight@​0.41.6

Patch Changes

• #4102 f1dddc0 Thanks @​delucis! - Adds 1 new icon: forgejo

@​astrojs/starlight@​0.41.5

Patch Changes

• #4095 bb06434 Thanks @​HiDeoo! - Fixes a regression when using a union to extend Starlight’s docsSchema().

@​astrojs/starlight@​0.41.4

Patch Changes

• #3936 712eedd Thanks @​miichom! - Fixes support for modifying Zod enums when passing an extend option to Starlight’s docsSchema()

• #4092 0896b91 Thanks @​delucis! - Fixes support for links containing a protocol like mailto: in the sidebar

• #4088 4486ba4 Thanks @​delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightly

Changelog

Sourced from @​astrojs/starlight's changelog.

0.41.6

Patch Changes

• #4102 f1dddc0 Thanks @​delucis! - Adds 1 new icon: forgejo

0.41.5

Patch Changes

• #4095 bb06434 Thanks @​HiDeoo! - Fixes a regression when using a union to extend Starlight’s docsSchema().

0.41.4

Patch Changes

• #3936 712eedd Thanks @​miichom! - Fixes support for modifying Zod enums when passing an extend option to Starlight’s docsSchema()

• #4092 0896b91 Thanks @​delucis! - Fixes support for links containing a protocol like mailto: in the sidebar

• #4088 4486ba4 Thanks @​delucis! - Simplifies Starlight’s client-side sidebar state persistence script slightly

Commits

• ae0838f [ci] release (#4106)
• f1dddc0 Add Forgejo icon (#4102)
• 5b06909 [ci] release (#4097)
• bb06434 Fix union schema extend regression (#4095)
• ab2792b [ci] release (#4090)
• 712eedd fix: invalid option error when modifying enums in docsSchema's extend (#3936)
• 0896b91 Support links with any protocol in sidebars (#4092)
• 4486ba4 Remove pagehide event from sidebar persistence script (#4088)
• See full diff in compare view

Updates astro from 7.1.3 to 7.1.6

Release notes

Sourced from astro's releases.

astro@7.1.6

Patch Changes

• #17536 ff97b86 Thanks @​dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

• #17383 296e1b0 Thanks @​thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

• #17543 bbc1ec9 Thanks @​ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

  For example, you can reduce the size of chunks to 1MB:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: {
  type: 'chunked',
  chunkSize: 1024 * 1024,
  },
  },
  });

• #17545 5214663 Thanks @​ematipico! - Bumps the Astro compiler to the latest version. Changelog.

astro@7.1.5

Patch Changes

• #17524 7613030 Thanks @​matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

• #17480 f61ba9c Thanks @​florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

• #17525 e614b7b Thanks @​matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

• #17284 c775c1f Thanks @​matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

• #17474 c895b12 Thanks @​nicksnyder! - Updates dependency js-yaml to v4.3.0

• Updated dependencies [c895b12]:

  • @​astrojs/internal-helpers@​0.10.2
  • @​astrojs/markdown-remark@​7.2.2
  • @​astrojs/markdown-satteri@​0.3.5

astro@7.1.4

Patch Changes

• #17488 d4f266d Thanks @​emerson-d-lopes! - Fixes duplicate CSS files being emitted in server output when a prerendered page and a server-rendered page share the same styles (e.g. a shared layout importing Tailwind). The prerender and SSR environments each emitted their own copy of the same stylesheet (index.X.css and _..Y.css); the SSR build now reuses the CSS asset filename from the prerender build when the stylesheet is backed by the same CSS source modules, so only a single file is emitted.

... (truncated)

Changelog

Sourced from astro's changelog.

7.1.6

Patch Changes

• #17536 ff97b86 Thanks @​dmgawel! - Fixes concurrent static builds failing to generate i18n rewrite fallbacks for dynamic routes

• #17383 296e1b0 Thanks @​thelazylamaGit! - Fixes stale dev CSS after editing component style blocks and CSS files in dev

• #17543 bbc1ec9 Thanks @​ematipico! - Adds a feature to experimental.collectionStorage that allows to change the size of chunks.

  For example, you can reduce the size of chunks to 1MB:

  // astro.config.mjs
  import { defineConfig } from 'astro/config';
  export default defineConfig({
  experimental: {
  collectionStorage: {
  type: 'chunked',
  chunkSize: 1024 * 1024,
  },
  },
  });

• #17545 5214663 Thanks @​ematipico! - Bumps the Astro compiler to the latest version. Changelog.

7.1.5

Patch Changes

• #17524 7613030 Thanks @​matthewp! - Fixes a bug where an error while finalizing a request could prevent a response from being sent

• #17480 f61ba9c Thanks @​florian-lefebvre! - Fixes a case where a custom logger.entrypoint failed to load at runtime in a built server bundle.

• #17525 e614b7b Thanks @​matthewp! - Fixes action path resolution so that properties of a resolved action function are not treated as routable path segments

• #17284 c775c1f Thanks @​matthewp! - Fixes a bug where the custom 404 (or 500) page was not rendered when a middleware rewrite targeted a route that returned an empty 404/500 response, and a blank page was returned instead

• #17474 c895b12 Thanks @​nicksnyder! - Updates dependency js-yaml to v4.3.0

• Updated dependencies [c895b12]:

  • @​astrojs/internal-helpers@​0.10.2
  • @​astrojs/markdown-remark@​7.2.2
  • @​astrojs/markdown-satteri@​0.3.5

7.1.4

Patch Changes

... (truncated)

Commits

• 9865d1c [ci] release (#17539)
• 5214663 fix: bump compiler (#17545)
• bbc1ec9 fix: chuncked content collections (#17543)
• 296e1b0 fix(dev): refresh stale CSS for component \<style> block HMR (#17383)
• ff97b86 fix(build): introduce two-staged build to prevent race condition with concurr...
• b0535ca [ci] release (#17528)
• c895b12 Update js-yaml to 4.3.0 (#17474)
• f61ba9c fix(logger): loading at runtime when entrypoint is a URL (#17480)
• e614b7b fix(astro): do not resolve action function properties as path segments (#17525)
• 7613030 Return a response when request finalization fails (#17524)
• Additional commits viewable in compare view

Updates satori from 0.28.1 to 0.29.0

Release notes

Sourced from satori's releases.

0.29.0

0.29.0 (2026-07-23)

Features

• add support for webp images (#622) (b712d5b), closes #607 #539 #273 #311

0.28.2

0.28.2 (2026-07-21)

Bug Fixes

• replace Yoga build flag for browsers (#774) (dc2e1c5), closes #749

Commits

• b712d5b feat: add support for webp images (#622)
• dc2e1c5 fix: replace Yoga build flag for browsers (#774)
• See full diff in compare view

Updates @iconify-json/material-icon-theme from 1.2.69 to 1.2.70

Commits

• See full diff in compare view

Updates @playwright/test from 1.61.1 to 1.62.1

Release notes

Sourced from @​playwright/test's releases.

v1.62.1

Bug Fixes

• #41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });
</tr></table>

... (truncated)

Commits

• 26a9e47 cherry-pick(#42043): docs: release notes for v1.62 Python, Java, and .NET (#4...
• 0a81d5d cherry-pick(#42040): docs(release-notes): mention the isolated headless clipb...
• 8376826 cherry-pick(#42034): fix(aria): keep icon-only clickable elements in ai snaps...
• 66c5cc9 chore: mark v1.62.1 (#42020)
• 9672bc3 cherry-pick(#42009): fix(types): support branded primitives in evaluate argum...
• 4325804 cherry-pick(#41988): fix(aria): preserve names from collapsed text contributors
• 9632f8e cherry-pick(#42005): fix(tsconfig): do not throw when "extends"/"references" ...
• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• Additional commits viewable in compare view

Updates astro-vtbot from 3.0.0 to 3.0.1

Changelog

Sourced from astro-vtbot's changelog.

3.0.1 - 2026-07-30

Patch Changes

• 19a0839: Updates dependencies, especially now comes with @​vtbag/utensil-drawer@​1.2.17

• ae7ac18: Additionally exports remarkEndOfMarkdown now also as mdastEndOfMarkdown. For all who prefer that name when switching Starlight from remark to mdast for Sätteri.

  See the StarlightPlugin page for details.

Commits

• See full diff in compare view

Updates eslint from 10.7.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

Commits

• 36c7659 17.8.0
• 7394811 Update globals (2026-07-01) (#347)
• See full diff in compare view

Updates prettier from 3.9.5 to 3.9.6

Release notes

Sourced from prettier's releases.

3.9.6

What's Changed

• Preserve quotes for methods named new (prettier/prettier#19621 by @​kovsu)
• Support import defer in typescript parser (prettier/prettier#19624, prettier/prettier#19675 by @​fisker)
• Added a new official plugin @prettier/plugin-yuku 🚀 (prettier/prettier#19628, prettier/prettier#19629 by @​fisker)

🔗 Changelog

Changelog

Sourced from prettier's changelog.

3.9.6

diff

TypeScript: Preserve quotes for methods named new (#19621 by @​kovsu)

// Input
interface Container {
  "new"(id: string): number;
}
// Prettier 3.9.5
interface Container {
new(id: string): number;
}
// Prettier 3.9.6
interface Container {
"new"(id: string): number;
}

TypeScript: Support import defer (#19624, #19675 by @​fisker)

// Input
import defer * as foo from "foo";
// Prettier 3.9.5
import * as foo from "foo";
// Prettier 3.9.6
import defer * as foo from "foo";

JavaScript: Added a new official plugin @prettier/plugin-yuku (#19628, #19629 by @​fisker)

@prettier/plugin-yuku is powered by Yuku (A high-performance JavaScript/TypeScript compiler toolchain written in Zig).

This plugin includes two new parsers: yuku (JavaScript syntax) and yuku-ts (TypeScript syntax).

To use this plugin:

1. Install the plugin:

   yarn add --dev prettier @prettier/plugin-yuku

... (truncated)

Commits

• 8f0c950 Release 3.9.6
• e910764 Update changelog
• ec3f1c7 Update typescript-eslint to v8.65.0 (#19675)
• 73d2efc Update Yuku parser to v0.7.0 (#19664)
• dd5e24e Preserve quotes for TSMethodSignature nodes named new (#19621)
• c03ab4e Update dependency eslint-plugin-unicorn to v72 (#19633)
• b74dd53 Update Yuku parser to v0.6.5 (#19654)
• f1b594e Update dependency eslint-plugin-simple-import-sort to v14 (#19655)
• 0d9dfb6 Update Yuku parser to v0.6.4 (#19650)
• 3bbb815 Remove typescript-only directory (#19636)
• Additional commits viewable in compare view

Updates typescript from 6.0.3 to 7.0.2

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by microsoft1es, a new releaser for typescript since your current version.

[Copilot]

Pull request overview

Note

Copilot could not run the full agentic suite for this review because it was automatically requested on a bot-authored pull request. Request a review from Copilot under Reviewers to retry with the full agentic suite. Improved support for bot-authored pull requests is coming soon.

Updates frontend build/tooling dependencies to newer patch/minor releases.

Changes:

• Bumped Astro-related packages (Astro core, markdown/MDX, Starlight).
• Updated developer tooling (Playwright, ESLint, Prettier, Globals).
• Upgraded TypeScript dependency.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[David Pine (IEvangelist)]

The postcss bump in this group is superseded by the green, checks-passing #1423 (postcss 8.5.25). This group PR currently fails ci-gate / rontend-build due to unrelated major updates (e.g. typescript 6→7), so it is not the canonical vehicle for the security cluster.

It does uniquely carry brace-expansion → 5.0.9 (alert #108); leaving open pending a green path for that bump. — automated-security

[David Pine (IEvangelist)]

Partially superseded by #1431. The two security bumps in this group — postcss (8.5.25, alert #109) and brace-expansion (5.0.9, alert #108) — are folded into the canonical [auto-sec] PR #1431. The remaining non-security updates in this group (including the TypeScript major bump) are out of scope for that security cluster and are left here for separate consideration.

[David Pine (IEvangelist)]

Superseded by #1431 for the security-relevant packages in this group: postcss (→ 8.5.25, clears GHSA-fxqj-rqcc-2cmp / alert #109) and brace-expansion (→ 5.0.9, clears GHSA-rgw5-rvv9-x895 / alert #108). #1431 is the canonical [auto-sec]\ remediation (mergeable, CI green) and surgically pins just those two transitive packages.

Closing this group PR as superseded for the security concern. The remaining non-security updates in the group (astro, eslint, prettier, typescript 6→7, satori, playwright, etc. — currently failing CI on the typescript 7 major) will be re-proposed by Dependabot on its next run, decoupled from the security fix.

[dependabot]

This pull request was built based on a group rule. Closing it will not ignore any of these versions in future pull requests.

To ignore these dependencies, configure ignore rules in dependabot.yml