chore(deps): bump the frontend group across 1 directory with 9 updates by dependabot[bot] · Pull Request #298 · resq-software/viz

dependabot · 2026-10-19T06:36:58Z

Bumps the frontend group with 9 updates in the /src/ResQ.Viz.Web directory:

Package	From	To
effect	`4.0.0-rc.115`	`4.0.5`
posthog-js	`1.434.0`	`1.438.12`
three	`0.186.0`	`0.186.1`
@axe-core/playwright	`4.13.0`	`4.14.0`
@playwright/test	`1.63.0`	`1.64.1`
@types/node	`26.6.1`	`26.6.5`
happy-dom	`20.14.5`	`21.0.3`
vite	`8.3.0`	`8.3.4`
vitest	`5.0.1`	`5.0.5`

Updates effect from 4.0.0-rc.115 to 4.0.5

Release notes

Sourced from effect's releases.

effect@4.0.5

Patch Changes

#9055 f665607 Thanks @Tyagiquamar! - Pass a NonEmptyArray to the onNonEmpty callback of Array.match when the input is a mutable array.

#9110 dbf442b Thanks @petar-omni! - Fix AsyncResult.all failures carrying a single input's previousSuccess instead of the combined record or tuple.

#9105 74d1930 Thanks @tim-smart! - Fix infinite atom rebuilds caused by late reads of uninitialized dependencies.

#9145 a03afb6 Thanks @jayhemnani9910! - Add Flag.withOptionalValue for GNU-style flags with an optional value, like --color[=WHEN]. A bare flag uses the given value; an explicit value must be attached with =.

#9131 f159284 Thanks @tim-smart! - Fix lost deferred callback wakes in cluster workflows when an activity suspends while a parallel activity is still running.

#9094 5d301cc Thanks @okxint! - Name cluster entity RPC server spans by entity type only (e.g. WorkflowEntity.Run) so span names stay low-cardinality. The entity ID is still recorded in the entity.id span attribute.

#9176 cd74ea2 Thanks @effect-bot! - Recover persisted local cluster replies from storage to prevent requests hanging when replies arrive before handler registration. Retain local reply notifications as storage-reader wakeups for low-latency streaming.

Defer terminal in-memory reply publication until the successful outer transaction completes, preserving the commit boundary for reply readers.

#9095 925cf64 Thanks @jayhemnani9910! - Fix ConfigProvider.fromDotEnv and fromDotEnvContents rescanning expanded values when expandVariables is enabled. Self and circular references no longer overflow the stack, escaped \$NAME stays literal, and defaults apply when a reference expands to an empty value.

#9109 54c51d9 Thanks @devangpratap! - Fix Duration conversions throwing for very large millisecond values, and make those durations equal to their nanosecond equivalents.

#9161 995c104 Thanks @devangpratap! - Fix Duration conversions losing nanosecond precision for large integer millisecond values.

#9112 816575e Thanks @effect-bot! - Use bigint for 64-bit FileSystem.File.Info metadata. dev is now a bigint, and ino, rdev, nlink, and blocks are Option<bigint>, so file stats no longer fail or drop values outside the safe integer range. Node and Bun read dev, ino, rdev, and nlink as unsigned 64-bit integers. Deno reports these fields as numbers, so values above Number.MAX_SAFE_INTEGER are rounded by Deno before conversion.

#9150 0df6e06 Thanks @tim-smart! - Support per-request URLs in GraphQLProtocol.layerHttp and makeHttp, as a function of the context and operation or as an Effect<string>. GraphQLResolver batches lookups by URL.

#9137 52a7d3c Thanks @tim-smart! - Add HttpClientRequest.compressBody for gzip and deflate request body compression.

#9160 ec831c3 Thanks @fubhy! - Accept Redacted values as URL parameters in UrlParams and HttpClientRequest.

#9138 3abc63e Thanks @tim-smart! - Add HttpMiddleware.decompression, which decompresses gzip and deflate request bodies, limits the decompressed size, and rejects other codings with 415.

#9113 a841b8b Thanks @effect-bot! - Fix interruption calling Math.random and hashing defects, which made deterministic hosts that forbid randomness loop forever or overflow the stack.

#9098 91efea7 Thanks @armancharan! - Narrow only the matched prefix when a Match tuple pattern is applied to an array or variadic tuple, so the remaining elements keep their original type.

#9151 e271997 Thanks @tim-smart! - Fix McpServer types to require schema services for resource templates and encoding services for prompt parameters with completion handlers. Missing services are now caught at compile time.

#9117 7719bda Thanks @jayhemnani9910! - Pad 64-bit trace ids to 128 bits in OTLP exports and traceparent headers.

#9139 563397f Thanks @tim-smart! - Add opt-in gzip compression to built-in OTLP JSON and protobuf exporters via the compression option or OTEL_EXPORTER_OTLP_COMPRESSION and per-signal environment variables. Compress batches once before retries using HttpClientRequest.compressBody, retaining its default 1KB threshold and uncompressed defaults.

#9127 65b04f8 Thanks @effect-bot! - Add Path.resolveWithin(root, input), which resolves a relative path beneath a root and returns Option.none() for traversal escapes and rooted inputs, using the platform's path rules.

#9143 c2859bf Thanks @danieljvdm! - Collect tool approvals once per LanguageModel request instead of twice.

#9134 c462214 Thanks @effect-bot! - Reduce SQLite statement overhead by borrowing the shared connection while preserving semaphore exclusion and failed-COMMIT recovery.

... (truncated)

Changelog

Sourced from effect's changelog.

4.0.5

Patch Changes

#9055 f665607 Thanks @Tyagiquamar! - Pass a NonEmptyArray to the onNonEmpty callback of Array.match when the input is a mutable array.

#9110 dbf442b Thanks @petar-omni! - Fix AsyncResult.all failures carrying a single input's previousSuccess instead of the combined record or tuple.

#9105 74d1930 Thanks @tim-smart! - Fix infinite atom rebuilds caused by late reads of uninitialized dependencies.

#9145 a03afb6 Thanks @jayhemnani9910! - Add Flag.withOptionalValue for GNU-style flags with an optional value, like --color[=WHEN]. A bare flag uses the given value; an explicit value must be attached with =.

#9131 f159284 Thanks @tim-smart! - Fix lost deferred callback wakes in cluster workflows when an activity suspends while a parallel activity is still running.

#9094 5d301cc Thanks @okxint! - Name cluster entity RPC server spans by entity type only (e.g. WorkflowEntity.Run) so span names stay low-cardinality. The entity ID is still recorded in the entity.id span attribute.

#9176 cd74ea2 Thanks @effect-bot! - Recover persisted local cluster replies from storage to prevent requests hanging when replies arrive before handler registration. Retain local reply notifications as storage-reader wakeups for low-latency streaming.

Defer terminal in-memory reply publication until the successful outer transaction completes, preserving the commit boundary for reply readers.

#9095 925cf64 Thanks @jayhemnani9910! - Fix ConfigProvider.fromDotEnv and fromDotEnvContents rescanning expanded values when expandVariables is enabled. Self and circular references no longer overflow the stack, escaped \$NAME stays literal, and defaults apply when a reference expands to an empty value.

#9109 54c51d9 Thanks @devangpratap! - Fix Duration conversions throwing for very large millisecond values, and make those durations equal to their nanosecond equivalents.

#9161 995c104 Thanks @devangpratap! - Fix Duration conversions losing nanosecond precision for large integer millisecond values.

#9112 816575e Thanks @effect-bot! - Use bigint for 64-bit FileSystem.File.Info metadata. dev is now a bigint, and ino, rdev, nlink, and blocks are Option<bigint>, so file stats no longer fail or drop values outside the safe integer range. Node and Bun read dev, ino, rdev, and nlink as unsigned 64-bit integers. Deno reports these fields as numbers, so values above Number.MAX_SAFE_INTEGER are rounded by Deno before conversion.

#9150 0df6e06 Thanks @tim-smart! - Support per-request URLs in GraphQLProtocol.layerHttp and makeHttp, as a function of the context and operation or as an Effect<string>. GraphQLResolver batches lookups by URL.

#9137 52a7d3c Thanks @tim-smart! - Add HttpClientRequest.compressBody for gzip and deflate request body compression.

#9160 ec831c3 Thanks @fubhy! - Accept Redacted values as URL parameters in UrlParams and HttpClientRequest.

#9138 3abc63e Thanks @tim-smart! - Add HttpMiddleware.decompression, which decompresses gzip and deflate request bodies, limits the decompressed size, and rejects other codings with 415.

#9113 a841b8b Thanks @effect-bot! - Fix interruption calling Math.random and hashing defects, which made deterministic hosts that forbid randomness loop forever or overflow the stack.

#9098 91efea7 Thanks @armancharan! - Narrow only the matched prefix when a Match tuple pattern is applied to an array or variadic tuple, so the remaining elements keep their original type.

#9151 e271997 Thanks @tim-smart! - Fix McpServer types to require schema services for resource templates and encoding services for prompt parameters with completion handlers. Missing services are now caught at compile time.

#9117 7719bda Thanks @jayhemnani9910! - Pad 64-bit trace ids to 128 bits in OTLP exports and traceparent headers.

#9139 563397f Thanks @tim-smart! - Add opt-in gzip compression to built-in OTLP JSON and protobuf exporters via the compression option or OTEL_EXPORTER_OTLP_COMPRESSION and per-signal environment variables. Compress batches once before retries using HttpClientRequest.compressBody, retaining its default 1KB threshold and uncompressed defaults.

#9127 65b04f8 Thanks @effect-bot! - Add Path.resolveWithin(root, input), which resolves a relative path beneath a root and returns Option.none() for traversal escapes and rooted inputs, using the platform's path rules.

#9143 c2859bf Thanks @danieljvdm! - Collect tool approvals once per LanguageModel request instead of twice.

... (truncated)

Commits

7f524e2 Version Packages (#9099)
3ad9a0c Fix premature RPC socket ping timeouts (#9187)
f665607 fix(Array): make Array.match expose NonEmptyArray for mutable arrays (#9055)
0df6e06 GraphQL: per-request url function for layerHttp with URL-aware resolver batch...
7422b9b test(cluster): allow residency cap checks headroom on Deno (#9185)
bc454a3 Make String snake_case conversions total and skip empty noCase words (#9183)
3b87d1d Reduce clock polling in shard-release teardown test (#9184)
ec831c3 Accept Redacted values as HTTP URL params (#9160)
cd74ea2 Fix lost replies for persisted local cluster requests (#9176)
2a8ec8b perf(schema): keep successful decoding defaults resolved (#9166)
Additional commits viewable in compare view

Updates posthog-js from 1.434.0 to 1.438.12

Release notes

Sourced from posthog-js's releases.

posthog-js@1.438.12

1.438.12

Patch Changes

#5298 e940c92 Thanks @github-actions! - Prevent backward device clock changes from subtracting client rate-limit tokens. (2026-10-15)

posthog-js@1.438.11

1.438.11

Patch Changes

#5260 845bf99 Thanks @gesh! - Capture WebMCP failures in Error Tracking when exception autocapture is enabled. With posthog-js/slim, add ErrorTrackingExtensions next to WebMCPExtensions to get these events. (2026-10-15)

posthog-js@1.438.10

1.438.10

Patch Changes

#5300 09d4ba2 Thanks @rafaeelaudibert! - Capture the Freebuff click identifier (bfcid) as a campaign parameter, so it is set on events and as $initial_bfcid like every other ad click ID. (2026-10-14)

Updated dependencies [09d4ba2]:

@posthog/browser-common@0.9.5

@posthog/core@1.59.1

posthog-js@1.438.9

1.438.9

Patch Changes

#5281 8f2d581 Thanks @marandaneto! - Fix before_send callback types to accept non-null events while still allowing null returns to drop events. (2026-10-12)

Updated dependencies [8f2d581]:

@posthog/types@1.415.3

@posthog/core@1.58.1

posthog-js@1.438.8

1.438.8

Patch Changes

#5259 ba4cc49 Thanks @gesh! - Capture WebMCP error types and sanitized messages. (2026-10-12)

posthog-js@1.438.7

1.438.7

Patch Changes

... (truncated)

Commits

de2c035 chore: update versions and lockfile [version bump]
e940c92 fix: Backward clock changes make the browser rate-limit token balance negativ...
c775115 chore: update versions and lockfile [version bump]
7319620 chore: allow anthropic sdk 0134 (#5305)
845bf99 feat: capture WebMCP exceptions (#5260)
64a2b36 chore: update versions and lockfile [version bump]
b21765a fix(react-native): stop dropping native crash reports for fatals JS did not s...
25f6b28 chore: update versions and lockfile [version bump]
09d4ba2 feat(browser): capture the Freebuff bfcid click ID (#5300)
d7e7652 chore: update versions and lockfile [version bump]
Additional commits viewable in compare view

Updates three from 0.186.0 to 0.186.1

Commits

See full diff in compare view

Updates @axe-core/playwright from 4.13.0 to 4.14.0

Release notes

Sourced from @axe-core/playwright's releases.

Release 4.14.0

What's Changed

docs(webdriverjs): update chrome options in example by @G-Rath in dequelabs/axe-core-npm#1401

chore: merge master into develop by @attest-team-ci in dequelabs/axe-core-npm#1417

ci: create the release tag when publishing to production by @Garbee in dequelabs/axe-core-npm#1418

chore: bump brace-expansion by @dependabot[bot] in dequelabs/axe-core-npm#1419

chore: bump tar and lerna by @dependabot[bot] in dequelabs/axe-core-npm#1420

chore: migrate from npm workspaces to pnpm by @Garbee in dequelabs/axe-core-npm#1421

chore(deps): upgrade dependencies and audit engine floors in CI by @Garbee in dequelabs/axe-core-npm#1430

chore: bump chromedriver from 152.0.0 to 152.0.1 in the browser-drivers group by @dependabot[bot] in dequelabs/axe-core-npm#1435

chore: bump the webdriverio group with 6 updates by @dependabot[bot] in dequelabs/axe-core-npm#1434

chore: bump eslint from 10.8.1 to 10.9.0 by @dependabot[bot] in dequelabs/axe-core-npm#1437

fix: exempt axe-core from the pnpm release-age cooldown by @Garbee in dequelabs/axe-core-npm#1441

feat: Update axe-core to v4.14.0 by @attest-team-ci in dequelabs/axe-core-npm#1456

chore: bump postcss-selector-parser from 7.1.5 to 7.1.6 by @dependabot[bot] in dequelabs/axe-core-npm#1457

chore: bump puppeteer from 25.8.0 to 25.12.0 in the puppeteer group by @dependabot[bot] in dequelabs/axe-core-npm#1451

chore: bump proxy-addr from 2.0.7 to 2.0.8 by @dependabot[bot] in dequelabs/axe-core-npm#1458

chore: bump nx from 23.1.1 to 23.2.1 by @dependabot[bot] in dequelabs/axe-core-npm#1459

chore: bump adm-zip from 0.6.0 to 0.6.1 by @dependabot[bot] in dequelabs/axe-core-npm#1443

chore: bump the webdriverio group across 1 directory with 7 updates by @dependabot[bot] in dequelabs/axe-core-npm#1449

ci: provide pnpm via action-setup in release workflows by @Garbee in dequelabs/axe-core-npm#1461

chore: RC v4.14.0 by @attest-team-ci in dequelabs/axe-core-npm#1463

fix(cli): restore bin paths and lint published package tarballs (#1467) by @Garbee in dequelabs/axe-core-npm#1468

chore: release v4.14.0 by @axe-core in dequelabs/axe-core-npm#1479

New Contributors

@G-Rath made their first contribution in dequelabs/axe-core-npm#1401

Full Changelog: dequelabs/axe-core-npm@v4.13.0...v4.14.0

Changelog

Sourced from @axe-core/playwright's changelog.

4.14.0 (2026-10-06)

Bug Fixes

exempt axe-core from the pnpm release-age cooldown (#1441) (0bcb185), closes #1346 #1346 #1442 #1346

Features

Update axe-core to v4.14.0 (#1456) (dccfe7a)

Commits

2375f7f chore: release v4.14.0 (#1479)
d1531a9 fix(cli): restore bin paths and lint published package tarballs (#1467) (#1468)
8b31968 fix(cli): restore bin paths and lint published package tarballs (#1467)
556d23c chore: RC v4.14.0 (#1463)
74c9144 chore: RC v4.14.0
5617347 ci: provide pnpm via action-setup in release workflows (#1461)
6da92cb chore: bump the webdriverio group across 1 directory with 7 updates (#1449)
36e019f chore: bump adm-zip from 0.6.0 to 0.6.1 (#1443)
e820472 chore: bump nx from 23.1.1 to 23.2.1 (#1459)
4fe97e0 chore: bump proxy-addr from 2.0.7 to 2.0.8 (#1458)
Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @playwright/test's releases.

v1.64.1

Bug Fixes

#43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0

#43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:
const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"
Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:
playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'
🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:
// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
866cbb8 chore: mark v1.64.1 (#43354)
1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
Additional commits viewable in compare view

Updates @types/node from 26.6.1 to 26.6.5

Commits

See full diff in compare view

Updates happy-dom from 20.14.5 to 21.0.3

Release notes

Sourced from happy-dom's releases.

v21.0.3

👷‍♂️ Patch fixes

Fixes security vulnerability where authorization header was forwarded when redirecting - By @capricorn86

v21.0.2

👷‍♂️ Patch fixes

Fixes SSRF security vulnerability by doing a target-origin bypass in the proxy server in @happy-dom/server-renderer - By @capricorn86

v21.0.1

👷‍♂️ Patch fixes

Adds alias for enabling CSS and iframe loading to @happy-dom/server-renderer - By @capricorn86

v21.0.0

💣 Breaking Changes

Disables CSS and IFrame loading by default to prevent server-side request forgery (SSRF) - By @capricorn86

An attacker could embed <iframe> or <link rel="stylesheet"> elements in untrusted HTML to make Happy DOM send HTTP requests from the server to attacker-chosen URLs, including internal services. This could allow access to otherwise unreachable endpoints or trigger unintended actions, depending on the application and its network access.

The settings property disableCSSFileLoading has been deprecated

Added the new settings properties enableCSSFileLoading and enableIframePageLoading

v20.14.6

👷‍♂️ Patch fixes

Fixes cookie scope forgery vulnerability - By @capricorn86

Commits

875ef5c fix: Fixes security vulnerability where authorization header was forwarded wh...
1f3ffdf fix: Fixes SSRF security vulnerability by doing a target-origin bypass in the...
f55c7e0 chore: Update security documentation (#2509)
2b91e68 fix: Adds alias for enabling CSS and iframe loading in server-renderer (#2503)
0a99c75 BREAKING CHANGE: Disables CSS and IFrame loading by default (#2502)
f21dbd7 fix: Fixes cookie scope forgery vulnerability (#2477)
See full diff in compare view

Updates vite from 8.3.0 to 8.3.4

Release notes

Sourced from vite's releases.

v8.3.4

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)

build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)

bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)

client: skip rewriting unchanged adopted styles (#23697) (fa71469)

css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)

deps: update all non-major dependencies (#23648) (8a4c19c)

deps: update rolldown-related dependencies (#23649) (794516d)

dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)

don't treat modules ending with js-like query as js (#23687) (fcb6f12)

html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)

html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)

optimizer: scan deep imports with custom extensions (#23678) (8579189)

remove input option unescaping for now (#23694) (facc2fb)

server: match static aliases on path boundaries (#23643) (b28db28)

watcher: normalize file before root check in ensureWatchedFile (#23673) (12bb28c)

Performance Improvements

module-runner: skip cloning call sites that have no source map (#23646) (3d67486)

Code Refactoring

bundled-dev: import CSS HMR helpers from /@vite/client (#23674) (182f5b2)

v8.3.3

Bug Fixes

deps: update launch-editor to v2.14.2 (#23654) (22fd1d5)

html: filename passed to transformIndexHtml should not include queries (#23653) (7dafd8e)

server: check fs.serve for ?vite-wasm-instance (#23655) (ba8b7ab)

server: store ids to safeModulePaths rather than URLs (#23656) (c3e06f9)

v8.3.2

Bug Fixes

build: preload CSS correctly when renderBuiltUrl returns URLs with queries (#23611) (64e0a21)

bundled-dev: serve lazy chunk sourcemaps (#23026) (eb7aa9a)

bundled-dev: serve the rolldown runtime from the installed rolldown (#23568) (bc598a6)

deps: update all non-major dependencies (#23601) (9944fa6)

deps: update rolldown-related dependencies (#23602) (88c1741)

html: resolve percent-encoded srcset urls (#23609) (53f1ce7)

limit size of object and array printing via forwardConsole (#23565) (e64a587)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.4 (2026-10-08)

Features

bundled-dev: support import.meta.hot.acceptExports (#23463) (bc0f21c)

Bug Fixes

avoid mutating hmr defaults (fix #23575) (#23576) (574d5e3)

build: correct preloads when chunkImportMap is enabled with non-root base (#23698) (2a8c0f0)

build: wait for in-flight stylesheets in preload helper (fix #23652) (#23662) (036b745)

bundled-dev: serve /@vite/client and stub @vite/env (#23664) (5afc5a8)

client: skip rewriting unchanged adopted styles (#23697) (fa71469)

css: resolve imported preprocessors from their file path with lightningcss (#23688) (cf52011)

deps: update all non-major dependencies (#23648) (8a4c19c)

deps: update rolldown-related dependencies (#23649) (794516d)

dev: a restart requested during a restart used to be dropped (fix #23392) (#23484) (70d56ea)

don't treat modules ending with js-like query as js (#23687) (fcb6f12)

html: avoid adding filesystem root to watcher (#23689) (3a7f2ae)

html: skip caching CSS of chunks in a cycle (fix #23628) (#23636) (15d82f7)

optimizer: scan deep imports with custom extensions (#23678<...
Description has been truncated

Bumps the frontend group with 9 updates in the /src/ResQ.Viz.Web directory: | Package | From | To | | --- | --- | --- | | [effect](https://github.com/Effect-TS/effect/tree/HEAD/packages/effect) | `4.0.0-rc.115` | `4.0.5` | | [posthog-js](https://github.com/PostHog/posthog-js) | `1.434.0` | `1.438.12` | | [three](https://github.com/mrdoob/three.js) | `0.186.0` | `0.186.1` | | [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.13.0` | `4.14.0` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.63.0` | `1.64.1` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.6.1` | `26.6.5` | | [happy-dom](https://github.com/capricorn86/happy-dom) | `20.14.5` | `21.0.3` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.3.0` | `8.3.4` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `5.0.1` | `5.0.5` | Updates `effect` from 4.0.0-rc.115 to 4.0.5 - [Release notes](https://github.com/Effect-TS/effect/releases) - [Changelog](https://github.com/Effect-TS/effect/blob/main/packages/effect/CHANGELOG.md) - [Commits](https://github.com/Effect-TS/effect/commits/effect@4.0.5/packages/effect) Updates `posthog-js` from 1.434.0 to 1.438.12 - [Release notes](https://github.com/PostHog/posthog-js/releases) - [Changelog](https://github.com/PostHog/posthog-js/blob/main/CHANGELOG.md) - [Commits](https://github.com/PostHog/posthog-js/compare/posthog-js@1.434.0...posthog-js@1.438.12) Updates `three` from 0.186.0 to 0.186.1 - [Release notes](https://github.com/mrdoob/three.js/releases) - [Commits](https://github.com/mrdoob/three.js/commits) Updates `@axe-core/playwright` from 4.13.0 to 4.14.0 - [Release notes](https://github.com/dequelabs/axe-core-npm/releases) - [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md) - [Commits](dequelabs/axe-core-npm@v4.13.0...v4.14.0) Updates `@playwright/test` from 1.63.0 to 1.64.1 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.63.0...v1.64.1) Updates `@types/node` from 26.6.1 to 26.6.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `happy-dom` from 20.14.5 to 21.0.3 - [Release notes](https://github.com/capricorn86/happy-dom/releases) - [Commits](capricorn86/happy-dom@v20.14.5...v21.0.3) Updates `vite` from 8.3.0 to 8.3.4 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.3.4/packages/vite) Updates `vitest` from 5.0.1 to 5.0.5 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest) --- updated-dependencies: - dependency-name: effect dependency-version: 4.0.5 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend - dependency-name: posthog-js dependency-version: 1.438.12 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: frontend - dependency-name: three dependency-version: 0.186.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: frontend - dependency-name: "@axe-core/playwright" dependency-version: 4.14.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: frontend - dependency-name: "@playwright/test" dependency-version: 1.64.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: frontend - dependency-name: "@types/node" dependency-version: 26.6.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: frontend - dependency-name: happy-dom dependency-version: 21.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: frontend - dependency-name: vite dependency-version: 8.3.4 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: frontend - dependency-name: vitest dependency-version: 5.0.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: frontend ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2026-10-19T06:37:01Z

Labels

The following labels could not be found: chore, deps. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

coderabbitai · 2026-10-19T06:37:08Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults
Review profile: CHILL
Plan: Advanced
Run ID: 90788755-9a8e-4420-8c0b-7acfb4027817

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

🔍 Trigger review

Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

socket-security · 2026-10-19T06:37:28Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance	License
npm/happy-dom@20.14.5 ⏵ 21.0.3		⁺¹	⁺¹	^-30
npm/@axe-core/playwright@4.13.0 ⏵ 4.14.0		⁺¹	⁺¹
npm/vitest@5.0.1 ⏵ 5.0.5		⁺¹	⁺²
npm/@types/node@26.6.1 ⏵ 26.6.5		⁺¹	^-1
npm/vite@8.3.0 ⏵ 8.3.4	⁺¹	⁺¹
npm/posthog-js@1.434.0 ⏵ 1.438.12
npm/three@0.186.0 ⏵ 0.186.1	⁺¹
npm/effect@4.0.0-rc.115 ⏵ 4.0.5		⁺³	⁺¹
npm/@playwright/test@1.63.0 ⏵ 1.64.1

View full report

dependabot Bot requested a review from WomB0ComB0 as a code owner October 19, 2026 06:36

github-actions Bot added area:client Embedded Vite/TypeScript web client size/L C-Chore Chore: deps, tooling, or config with no public API change labels Oct 19, 2026

Navigation Menu

Repository navigation

chore(deps): bump the frontend group across 1 directory with 9 updates - #298

chore(deps): bump the frontend group across 1 directory with 9 updates#298
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/src/ResQ.Viz.Web/frontend-d436247560

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Oct 19, 2026

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Review skipped

Uh oh!

socket-security Bot commented Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Oct 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

effect@4.0.5

Patch Changes

4.0.5

Patch Changes

posthog-js@1.438.12

1.438.12

Patch Changes

posthog-js@1.438.11

1.438.11

Patch Changes

posthog-js@1.438.10

1.438.10

Patch Changes

posthog-js@1.438.9

1.438.9

Patch Changes

posthog-js@1.438.8

1.438.8

Patch Changes

posthog-js@1.438.7

1.438.7

Patch Changes

Release 4.14.0

What's Changed

New Contributors

4.14.0 (2026-10-06)

Bug Fixes

Features

v1.64.1

Bug Fixes

v1.64.0

🧰 WebMCP

🎬 Better videos

v21.0.3

👷‍♂️ Patch fixes

v21.0.2

👷‍♂️ Patch fixes

v21.0.1

👷‍♂️ Patch fixes

v21.0.0

💣 Breaking Changes

v20.14.6

👷‍♂️ Patch fixes

v8.3.4

Features

Bug Fixes

Performance Improvements

Code Refactoring

v8.3.3

Bug Fixes

v8.3.2

Bug Fixes

8.3.4 (2026-10-08)

Features

Bug Fixes

Uh oh!

dependabot Bot commented on behalf of github Oct 19, 2026

Labels

Uh oh!

coderabbitai Bot commented Oct 19, 2026

Review skipped

Uh oh!

socket-security Bot commented Oct 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Oct 19, 2026 •

edited

Loading