chore(deps): update npm packages - autoclosed by renovate[bot] · Pull Request #833 · voidzero-dev/vite-task

renovate · 2026-10-11T20:56:25Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@anthropic-ai/sandbox-runtime	`0.0.78` → `0.0.79`
@openai/codex (source)	`0.160.0` → `0.162.0`
@playwright/browser-chromium (source)	`1.63.0` → `1.64.0`
playwright (source)	`1.63.0` → `1.64.0`
typescript (source)	`7.1.0-dev.20261001.1` → `7.1.0-dev.20261008.1`
vite-task-tools>vite (source)	`8.3.2` → `8.3.4`

Release Notes

anthropics/sandbox-runtime (@anthropic-ai/sandbox-runtime)

`v0.0.79`

Compare Source

Fixed: denies that did not apply

Names with glob characters ([wip] app, br[1]), all platforms. A path entry whose characters read as a pattern is now also read as the path it spells, where that exists. Before, a deny through such a folder matched nothing. (#620, #622; #134, #576)
Linux, dangerous names in subdirectories. .bashrc, .git/config, .vscode/ and the like are write-denied one level below the working directory whatever else the tree holds, and a folder the scan cannot read is denied whole. (#629)

Faster, and off the caller's thread (Linux)

Expanding denyRead and allowRead patterns is about six times faster and uses less memory: six ** rules over 400,000 files, 6.3 s to 1.0 s. The rules of one configuration share their directory listings. (#627)
The expansion gives the event loop a turn every 10 ms, and stops when the AbortSignal passed to wrapWithSandbox() is aborted. (#628)
A wrap goes by one configuration and one working directory. If updateConfig(), initialize() or chdir() runs while a command is being wrapped, the wrap starts over and reads the disk again. After two restarts it finishes its walk without yielding. (#638, #644, #655)
A directory that cannot be listed is tried once per wrap, not once per rule, and the read lists hold each path once. 100 rules over 50 such directories on a slow mount: 72 s to 2.5 s, the same sandbox. (#645)

Fixed: other

Linux: a sandboxed command's first network call was sometimes refused, because the command could start before the in-sandbox relays listened. It now starts once both do. (#639; #616)
Network: an upstream that answered with an invalid status line or header made the HTTP proxy throw, which ended the process running it. The proxy now answers 502 Bad Gateway. (#660)
CLI: a binary built with bun build --compile starts again. It failed with Cannot find module '../package.json'. (#630)
bubblewrap 0.4 starts again: one mount per destination. (#580)

New

{ path, literal: true } in any of the four filesystem path lists marks an entry as a name, whatever characters it holds. (#621)

For whoever upgrades

Types (breaking at compile time): the four filesystem path lists are FilesystemPathEntry[], that is string | { path: string; literal: true }, where they were string[]. writeRootsOf() gives every write root. (#621)
Node: engines is >=22.12.0. (#636)

What's Changed

linux: make the read-deny glob walk about six times faster by @ronleizrowice-ant in #627
linux: the wrap walks its patterns in turns, and stops when its signal is aborted by @ronleizrowice-ant in #628
linux: deny every dangerous name of a subdirectory, not only those three levels down by @ronleizrowice-ant in #629
Raise the supported Node floor to 22.12, and move CI to Node 22 by @ronleizrowice-ant in #636
linux: one mount per destination, so bubblewrap 0.4 starts by @ronleizrowice-ant in #580
linux: a wrap that starts over keeps what it has walked, and ends by @ronleizrowice-ant in #638
linux: a wrap that starts over reads the disk again by @ronleizrowice-ant in #644
Glob walk: an anchor option, a directory taken as the name it is by @ronleizrowice-ant in #620
Let a caller mark a path entry literal: { path, literal: true } by @ronleizrowice-ant in #621
Read a path entry as the path it spells, where that exists by @ronleizrowice-ant in #622
linux: try a directory that cannot be listed once, and give each path once by @ronleizrowice-ant in #645
ci: run the Docker legs on Node 22, not on the image's Node 18 by @ronleizrowice-ant in #643
linux: a command starts once both relays listen by @ronleizrowice-ant in #639
linux: one wrap, one working directory, and no object taken for the same install by @ronleizrowice-ant in #655
cli: read the version through a static import, so a compiled binary starts by @TurtIeSocks in #630
Answer 502 when an upstream sends an invalid status code by @ant-kurt in #660
Release v0.0.79 by @ronleizrowice-ant in #637

New Contributors

@TurtIeSocks made their first contribution in #630

Full Changelog: anthropics/sandbox-runtime@v0.0.78...v0.0.79

microsoft/playwright (@playwright/browser-chromium)

`v1.64.0`

Compare Source

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');

for (const tool of await page.webmcp.tools())
  console.log(tool.name, tool.description);

const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';

export default defineConfig({
  use: {
    video: {
      mode: 'on',
      size: { width: 1920, height: 1080 },
      fps: 60,
      show: {
        actions: {
          style: {
            point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
            highlight: 'outline: 2px solid #&#8203;333; background: rgba(0, 128, 255, .15)',
            title: 'font-size: 16px',
          },
        },
      },
    },
  },
});

New fps option in testOptions.video, recordVideo and
screencast.start(). Firefox and WebKit currently capture up to 25 frames per second.
New style option takes CSS declarations for the point marker, the target
highlight and the action title. It replaces the fontSize option, which is now deprecated.
The cursor stays visible at the last action point, survives navigations and travels along a natural, eased path.
Videos are encoded with VP9 instead of VP8, which takes less CPU and produces smaller files of the same or better
quality.
All video options are also available in Playwright MCP and playwright-cli.

🎯 Test runner

New testProject.default option keeps a project in the config without running it by default. You can configure every browser you care about, and let a plain npx playwright test run just your favourite one:

// playwright.config.ts
import { defineConfig, devices } from '@playwright/test';

export default defineConfig({
  projects: [
    { name: 'chromium', use: devices['Desktop Chrome'] },
    { name: 'firefox', use: devices['Desktop Firefox'], default: false },
    { name: 'webkit', use: devices['Desktop Safari'], default: false },
  ],
});

npx playwright test                     # runs chromium only
npx playwright test --project=firefox   # runs firefox
npx playwright test --project="*"       # runs all three, for example on CI

New --shuffle command line option schedules tests in a random order, which helps to find tests that accidentally depend on each other.

npx playwright test --shuffle
# Running 42 tests using 4 workers, shuffle seed 271828182
# ...

# Pass the seed to reproduce the same order.
npx playwright test --shuffle 271828182

New lock option in test.describe.configure() adds test locks to all tests in a file or a group:
```
test.describe.configure({ lock: 'user-settings' });
```

New type option of toHaveScreenshot in testConfig.expect stores all unnamed screenshots as WebP:

// playwright.config.ts
export default defineConfig({
  expect: {
    toHaveScreenshot: { type: 'webp' },
  },
});

🪆 Locator.within()

New locator.within() combines two locators that you already have, reading in the natural order —
"this button, within that dialog":

const saveButton = page.getByRole('button', { name: 'Save' });
const dialog = page.getByTestId('settings-dialog');

await saveButton.within(dialog).click();

Relative locators such as locator.nth() or locator.first() are resolved inside each parent
separately, which makes column-like queries straightforward:

// The third cell of every row, not the third cell in the table.
const thirdColumn = page.getByRole('cell').nth(2).within(page.getByRole('row'));
await expect(thirdColumn).toHaveText(['Apple', 'Banana', 'Cherry']);

New APIs

New page.getByRef() locates an element by its aria ref, such as e2, reported by page.ariaSnapshot() in the 'ai' mode.
New option includeShadow in page.content() and frame.content() serializes open shadow roots as declarative shadow DOM.
New option signCount sets the initial signature counter of a virtual credential. credentials.create() and credentials.get() return the current signCount, and it is saved and restored together with the credentials in the storage state.
New fullConfig.filteredProjects lists the projects that were selected to run after applying the --project filter. It is available in global setup and reporters.

New apiRequestContext.addCookies(), apiRequestContext.cookies() and apiRequestContext.clearCookies() manage cookies of a request context, mirroring the BrowserContext methods:

await request.addCookies([{ name: 'session-id', value: '42', url: 'https://example.com' }]);
console.log(await request.cookies('https://example.com'));
await request.clearCookies({ name: 'session-id' });

Breaking changes ⚠️

screen property is now forwarded from the device descriptors. If you use ...devices['Desktop Chrome'] and alike, window.screen and media queries now see the emulated screen size. You can opt-out by explicitly setting screen to undefined:
```
// playwright.config.ts
export default defineConfig({
  use: {
    ...devices['Desktop Chrome'],
    screen: undefined,
  },
});
```
JSX in your test files now follows your tsconfig.json. Playwright compiles JSX in test files according to the jsx, jsxFactory, jsxFragmentFactory and jsxImportSource tsconfig options, and defaults to the automatic runtime from react/jsx-runtime.
--update-snapshots=missing now passes the test run. Tests that only create missing snapshots now pass in the 'missing' mode of testConfig.updateSnapshots, so that CI can generate new snapshots and verify the existing ones in a single run. The mode used when the option is not specified is now called 'default' and behaves as before: missing snapshots are written and the test fails.
Elements inside hidden iframes are considered hidden. Elements inside an iframe that is not visible, for example with visibility: hidden, are now considered hidden by actions, locator.isVisible() and expect(locator).toBeVisible().

Browser Versions

Chromium 156.0.8078.4
Mozilla Firefox 157.0
WebKit 27.2

This version was also tested against the following stable channels:

Google Chrome 155
Microsoft Edge 155

microsoft/TypeScript (typescript)

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)
build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)
build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)
bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)
client: skip rewriting unchanged adopted styles (#23697) (fa71469)
css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)
deps: update all non-major dependencies (#23648) (8a4c19c)
deps: update rolldown-related dependencies (#23649) (794516d)
dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)
don't treat modules ending with js-like query as js (#23687) (fcb6f12)
html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)
html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)
optimizer: scan deep imports with custom extensions (#23678) (8579189)
remove input option unescaping for now (#23694) (facc2fb)
server: match static aliases on path boundaries (#23643) (b28db28)
watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

`v8.3.3`

Compare Source

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)
html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)
server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)
server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

Branch creation
- "before 10am on monday"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-10-11T20:56:46Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance	License
npm/@playwright/browser-chromium@1.63.0 ⏵ 1.64.0
npm/playwright@1.63.0 ⏵ 1.64.0	⁺¹	⁺¹
npm/vite@8.3.2 ⏵ 8.3.4	⁺¹	⁺¹
npm/typescript@7.1.0-dev.20261001.1 ⏵ 7.1.0-dev.20261008.1	⁺¹	⁺¹
npm/@anthropic-ai/sandbox-runtime@0.0.78 ⏵ 0.0.79		⁺¹	^-1
npm/@openai/codex@0.160.0-win32-x64 ⏵ 0.162.0				⁺³¹

View full report

github-actions · 2026-10-11T21:01:29Z

fspy benchmark

linux

dynamic/launch             change  +0.47%  [ -6.60% ..  +7.19%]  overhead   +49.68%
dynamic/access             change  +0.20%  [-11.46% .. +10.87%]  overhead    +7.80%
dynamic/access-relative    change  +0.00%  [-12.13% .. +12.79%]  overhead   +57.25%
dynamic/access-contended   change  +2.56%  [ -6.21% ..  +9.55%]  overhead   +11.94%
static/launch              change  +1.23%  [ -4.76% ..  +7.89%]  overhead  +157.01%
static/access              change  +0.21%  [-10.64% .. +10.84%]  overhead  +738.99%
static/access-relative     change  -0.52%  [ -5.92% ..  +7.59%]  overhead +1043.09%
static/access-contended    change  +1.05%  [ -9.07% .. +12.42%]  overhead +2094.47%

macos

dynamic/launch             change  -0.63%  [ -4.53% ..  +3.90%]  overhead  +222.43%
dynamic/access             change  -1.16%  [ -5.28% ..  +3.78%]  overhead    +1.69%
dynamic/access-relative    change  -0.61%  [ -3.97% ..  +3.47%]  overhead  +229.94%
dynamic/access-contended   change  +0.24%  [ -6.22% .. +16.78%]  overhead    +0.49%

windows

dynamic/launch             change  +0.34%  [ -2.18% ..  +3.18%]  overhead   +25.69%
dynamic/access             change  -0.19%  [ -0.78% ..  +0.78%]  overhead    +0.78%
dynamic/access-relative    change  +0.00%  [ -2.33% ..  +1.61%]  overhead    +1.26%
dynamic/access-contended   change  +0.18%  [ -0.72% ..  +1.23%]  overhead    +1.10%

chore(deps): update npm packages

ac7a332

renovate Bot changed the title ~~chore(deps): update npm packages~~ chore(deps): update npm packages - autoclosed Oct 16, 2026

renovate Bot closed this Oct 16, 2026

renovate Bot deleted the renovate/npm-packages branch October 16, 2026 16:04

Navigation Menu

Repository navigation

chore(deps): update npm packages - autoclosed - #833

chore(deps): update npm packages - autoclosed#833
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/npm-packages

renovate Bot commented Oct 11, 2026

Uh oh!

socket-security Bot commented Oct 11, 2026

Uh oh!

github-actions Bot commented Oct 11, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Oct 11, 2026

Release Notes

Fixed: denies that did not apply

Faster, and off the caller's thread (Linux)

Fixed: other

New

For whoever upgrades

What's Changed

New Contributors

🧰 WebMCP

🎬 Better videos

🎯 Test runner

🪆 Locator.within()

New APIs

Breaking changes ⚠️

Browser Versions

Features

Bug Fixes

Performance Improvements

Code Refactoring

Bug Fixes

Configuration

Uh oh!

socket-security Bot commented Oct 11, 2026

Uh oh!

github-actions Bot commented Oct 11, 2026

fspy benchmark

linux

macos

windows

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants