chore(deps): Bump the npm-minor-patch group with 9 updates

[dependabot]

Bumps the npm-minor-patch group with 9 updates:

Package	From	To
@openreplay/tracker	18.1.3	18.1.5
dompurify	3.4.14	3.4.15
html2canvas-pro	2.4.0	2.4.1
maplibre-gl	6.6.0	6.7.0
sass-embedded	1.103.1	1.104.0
@playwright/test	1.62.1	1.63.0
@types/node	26.4.0	26.4.1
@types/react-dom	19.2.5	19.2.7
oxlint	1.80.0	1.81.0

Updates @openreplay/tracker from 18.1.3 to 18.1.5

Updates dompurify from 3.4.14 to 3.4.15

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.15

• Added better clobbering hardening when XML content is involved, thanks @​gnyselcuk
• Added several smaller hardening and edge-case improvements, thanks @​leechristensen
• Bumped several dependencies where possible

Commits

• 1d7460c release: 3.4.15 (#1609)
• See full diff in compare view

Updates html2canvas-pro from 2.4.0 to 2.4.1

Release notes

Sourced from html2canvas-pro's releases.

v2.4.1

Please refer to CHANGELOG.md for details.

Changelog

Sourced from html2canvas-pro's changelog.

2.4.1 (2026-09-01)

Bug Fixes

• prevent SVG offsets from serialization (66362ea)

Commits

• 4cc4d4b chore(release): v2.4.1
• d74dab3 Merge pull request #236 from devgru/fix-svg-offsets
• 66362ea fix: prevent SVG offsets from serialization
• See full diff in compare view

Updates maplibre-gl from 6.6.0 to 6.7.0

Release notes

Sourced from maplibre-gl's releases.

v6.7.0

✨ Features and improvements

• Support the style specification's font-faces property, with map.setFontFaces and map.getFontFaces and improve complex script languages such as Devanagari, Khmer, Burmese and Hebrew (#8237) (by @​HarelM)
• Wrap Thai, Khmer, Burmese, Lao, Tibetan, Javanese and Balinese labels at word boundaries instead of running them on in one line, which applies to every style whether or not it declares font-faces (#8237) (by @​HarelM)
• Throw GPUInitializationError from the Map constructor when the WebGL2 context cannot be created, instead of firing an error event no listener can catch and returning a partially constructed map (#8066) (by @​johncarmack1984)
• Allow adding an image source without a url. The source starts empty and makes no network request; call updateImage({image}) or updateImage({url}) later to show an image (#8167) (by @​mondsichtung)
• Skip symbol re-placement when its inputs are unchanged, so repaints from animated style images or custom layers cost a single frame (#8208) (by @​lucaswoj)
• Add Style#triggerSymbolPlacement, which re-places symbols when something the map cannot see for itself has moved them (#8208) (by @​lucaswoj)
• Make {validate: false} skip the style snapshot the style setters only build as error context, so adding layers one at a time no longer serializes the whole style on every call (#8259) (by @​lazerg)

🐞 Bug fixes

• Disable the navigation control's zoom-out button when viewport constraints prevent zooming out further (#5316) (by @​miakh)
• Keep a vector tile's etag when the tile is reloaded after a style change, so the next expiry refresh can still skip unchanged tiles (#3309) (by @​johncarmack1984)
• Fix project() and queryTerrainElevation disagreeing with the rendered terrain surface when the elevation lookup sampled a different DEM zoom than the drawn mesh (#8212) (by @​johncarmack1984)
• Draw numbers (e.g. “21” in “반포대로21길”) and short uppercase codes (e.g. “A1”) upright in vertical line labels instead of rotating them along the line (#5404) (by @​NEKOYASAN)
• Fix the camera jumping at the end of a pan or zoom gesture on terrain by sampling the center elevation from the rendered terrain surface (#7989, #3982) (by @​johncarmack1984)
• Ensure style state defaults are serialized (#8263) (by @​hiddewie)

Changelog

Sourced from maplibre-gl's changelog.

6.7.0

✨ Features and improvements

• Support the style specification's font-faces property, with map.setFontFaces and map.getFontFaces and improve complex script languages such as Devanagari, Khmer, Burmese and Hebrew (#8237) (by @​HarelM)
• Wrap Thai, Khmer, Burmese, Lao, Tibetan, Javanese and Balinese labels at word boundaries instead of running them on in one line, which applies to every style whether or not it declares font-faces (#8237) (by @​HarelM)
• Throw GPUInitializationError from the Map constructor when the WebGL2 context cannot be created, instead of firing an error event no listener can catch and returning a partially constructed map (#8066) (by @​johncarmack1984)
• Allow adding an image source without a url. The source starts empty and makes no network request; call updateImage({image}) or updateImage({url}) later to show an image (#8167) (by @​mondsichtung)
• Skip symbol re-placement when its inputs are unchanged, so repaints from animated style images or custom layers cost a single frame (#8208) (by @​lucaswoj)
• Add Style#triggerSymbolPlacement, which re-places symbols when something the map cannot see for itself has moved them (#8208) (by @​lucaswoj)
• Make {validate: false} skip the style snapshot the style setters only build as error context, so adding layers one at a time no longer serializes the whole style on every call (#8259) (by @​lazerg)

🐞 Bug fixes

• Disable the navigation control's zoom-out button when viewport constraints prevent zooming out further (#5316) (by @​miakh)
• Keep a vector tile's etag when the tile is reloaded after a style change, so the next expiry refresh can still skip unchanged tiles (#3309) (by @​johncarmack1984)
• Fix project() and queryTerrainElevation disagreeing with the rendered terrain surface when the elevation lookup sampled a different DEM zoom than the drawn mesh (#8212) (by @​johncarmack1984)
• Draw numbers (e.g. “21” in “반포대로21길”) and short uppercase codes (e.g. “A1”) upright in vertical line labels instead of rotating them along the line (#5404) (by @​NEKOYASAN)
• Fix the camera jumping at the end of a pan or zoom gesture on terrain by sampling the center elevation from the rendered terrain surface (#7989, #3982) (by @​johncarmack1984)
• Ensure style state defaults are serialized (#8263) (by @​hiddewie)

Commits

• e1736fd Bump js version to 6.7.0 (#8291)
• 2da4991 feat: support font-faces style property (#8237)
• a71cfb0 chore(deps-dev): bump cssnano from 8.0.10 to 9.0.0 (#8289)
• f9a40a5 Fix navigation control at the effective minimum zoom (#8261)
• 1e9194f fix: keep a vector tile's etag across reloads (#8276)
• 69562dd chore(deps-dev): bump @​types/node from 26.3.0 to 26.4.0 (#8271)
• afd30b4 chore(deps-dev): bump sharp from 0.35.3 to 0.35.4 (#8269)
• aff418d chore(deps-dev): bump @​unicode/unicode-17.0.0 from 1.6.17 to 2.0.2 (#8284)
• 4013312 chore(deps-dev): bump pretty-bytes from 7.1.1 to 7.1.2 (#8283)
• 87bd3ba chore(deps-dev): bump st from 4.0.4 to 4.0.10 (#8281)
• Additional commits viewable in compare view

Updates sass-embedded from 1.103.1 to 1.104.0

Changelog

Sourced from sass-embedded's changelog.

1.104.0

• Potentially breaking compatibility fix: Colors now convert the special values NaN and negative zero, as well as infinity and negative infinity for polar-hue channels, to 0 as per the CSS spec.

• The special value negative zero is now serialized as -0 instead of 0 for greater compatibility when using it in CSS calculations.

Commits

• 191d6aa Update Dart Sass version and release
• See full diff in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @types/node from 26.4.0 to 26.4.1

Commits

• See full diff in compare view

Updates @types/react-dom from 19.2.5 to 19.2.7

Commits

• See full diff in compare view

Updates oxlint from 1.80.0 to 1.81.0

Release notes

Sourced from oxlint's releases.

oxlint v1.81.0 & oxfmt v0.66.0

Table of Contents

• Oxlint v1.81.0
• Oxfmt v0.66.0

Oxlint v1.81.0

🚀 Features

• 60b945d linter/nextjs/no-typos: Implement suggestion (#26091) (Mikhail Baev)

🐛 Bug Fixes

• 33ac4b0 linter/lsp: Prevent tsgolint from holding onto processes (#25570) (Adrian Schaedle)
• baf4b1e linter/import/no-empty-named-blocks: Make empty value import removal a suggestion (#26155) (camc314)
• 77cfaec linter/eslint/object-shorthand: Preserve __proto__ semantics (#26154) (camc314)
• fa3c082 linter/unicorn/prefer-set-size: Ignore shadowed Set constructors (#26153) (camc314)
• e412cf2 linter: Clamp invalid JS plugin locations (#26144) (camc314)
• d86c113 linter: Normalize reversed JS plugin locations (#26138) (camc314)
• 73c09b2 linter/eslint/no-use-before-define: Run on JS, JSX files (#26114) (camc314)
• 03ef0f2 linter/unicorn/no-useless-spread: Treat typed arrays as a distinct value hint (#26067) (Aadharsh Pannirselvam)
• bd15905 linter/react/no-unstable-nested-components: Check nested component object property names (#26101) (camc314)
• 3910e2b linter/eslint/no-unassigned-vars: Skip Svelte and Vue files (#26042) (Hamody We)
• 047f7ca linter/plugins: Fix interaction between JS plugins and Vue rules (#26080) (overlookmotel)
• 8531b9b linter/plugins: Alter method for obtaining mutable Program when sending AST to JS plugins (#26077) (overlookmotel)
• dc464ff linter/unicorn/prefer-math-min-max: Avoid unsafe autofix (#26060) (camc314)

📚 Documentation

• 464ddd1 linter: Support a shared short description for jest/vitest rules (#26186) (connorshea)
• 9db5ad3 linter: Add short description to vue/no-dupe-keys (#26183) (connorshea)
• db66f58 linter: Correct export/import mismatch in bar and foo example (#25927) (billychannnnnn)
• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

Oxfmt v0.66.0

🚀 Features

• 1fb37b6 formatter/css: Format declaration-shaped raw-prelude rules (postcss nested config blocks) (#26194) (leaysgur)

🐛 Bug Fixes

• 9f81002 formatter: Re-add suppressed statement terminators per options.semi (#26220) (leaysgur)
• 769ffd5 formatter: Print suppressed typecast parens (#26218) (leaysgur)
• 5ff57f8 formatter/sort-imports: Handle custom side effect groups (#26217) (leaysgur)
• 2f4d759 formatter: Do not skip cast comment lookup (#26216) (leaysgur)
• 1213e12 formatter: Preserve comment for statement terminators and binary casts (#26213) (leaysgur)
• 57e8e22 formatter_css: Space a folded sign after a call in Less operations (#26134) (leaysgur)
• e4298fb formatter/jsdoc: Follow CommonMark for interrupting lists and guard wrapping from creating them (#26098) (leaysgur)
• a1e21c2 formatter: Apply head body policy everywhere (#26074) (leaysgur)
• 676b7e1 formatter: Keep comments in their for-head slot, before an empty-statement body and do-while (#26073) (leaysgur)

... (truncated)

Changelog

Sourced from oxlint's changelog.

[1.81.0] - 2026-08-31

📚 Documentation

• d5be037 linter/typescript/switch-exhaustiveness-check: Clarify default case comment pattern (#26100) (camc314)

[1.79.0] - 2026-08-18

💥 BREAKING CHANGES

• 8c4552d linter: [BREAKING] Split react/react-compiler into per-category rules (#25500) (Boshen)

🐛 Bug Fixes

• 228e8e0 linter: Resolve inactive React compiler rules (#25830) (Boshen)
• aa49d86 linter: Allow spread rule options in config types (#25675) (ch3rry)
• 36f8451 linter/eslint/no-eval: Align indirect default with ESLint (#25656) (camc314)
• beb724d linter/eslint/no-unused-vars: Report bare underscore parameters (#25663) (camc314)
• 4004c10 linter/eslint/no-irregular-whitespace: Check comments by default (#25660) (camc314)
• 285820e linter/no-large-snapshots: Precompile and document allowed snapshot matchers (#25611) (Mikhail Baev)
• 4df5835 linter: Allow capitalized built-in calls (#25516) (Boshen)

[1.78.0] - 2026-08-10

🚀 Features

• ccb8fe8 linter/jsdoc: Implement no-blank-blocks rule (#25207) (Mikhail Baev)
• d4a897c linter/eslint: Implement one-var rule (#24470) (Cole Ellison)
• 5ab9340 linter/jsx-a11y/anchor-has-content: Add options to match eslint (#24571) (Cole Ellison)

🐛 Bug Fixes

• 9573937 linter/typescript: Validate ban-ts-comment description_format (#25320) (Mikhail Baev)

[1.77.0] - 2026-08-03

🐛 Bug Fixes

• 5c0fa61 linter/eslint/no-warning-comments: Unify config structs and remove manual options docs (#25151) (Mikhail Baev)

📚 Documentation

• 9dc7756 linter/typescript/no-unnecessary-condition: Clarify options (#25110) (camc314)

[1.76.0] - 2026-07-27

🚀 Features

• 8d31dfa linter: Verify eslint/no-restricted-globals config schema (#24598) (vigneshwar)
• 7069621 linter: Verify jest/vitest prefer-lowercase-title config schema (#24724) (Bartok)

... (truncated)

Commits

• 0b4e2e6 release(apps): oxlint v1.81.0 && oxfmt v0.66.0 (#26199)
• d5be037 docs(linter/typescript/switch-exhaustiveness-check): clarify default case com...
• 63bc313 chore(npm): update funding URL (#26066)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[github-actions]

⚠️ Playwright E2E — 0 passed · 18 failed · 0 flaky · 4 skipped

Full report