[dependabot]

Bumps the root-routine-updates group with 6 updates in the / directory:

Package	From	To
sql.js	1.14.2	1.15.0
@types/node	26.5.1	26.6.5
mocha	12.0.1	12.0.3
ovsx	1.2.0	1.3.0
playwright-core	1.63.0	1.64.1
tsx	4.23.13	4.23.15

Updates sql.js from 1.14.2 to 1.15.0

Release notes

Sourced from sql.js's releases.

Release v1.15.0

This release adds single-file WebAssembly builds and updates SQLite from 3.49.1 to 3.54.0.

• Add sql-wasm-inline.js and worker.sql-wasm-inline.js, with debug variants. These embed the WebAssembly binary and need no companion .wasm file or locateFile configuration.
• Deprecate asm.js builds. They remain in the npm package and sqljs-all.zip; use the inline WebAssembly builds for single-file integration.
• Preserve embedded NUL characters when binding or reading TEXT and passing TEXT to or from JavaScript SQL functions (#634).
• Allocate SQL strings on the heap in Database.run and Database.prepare, fixing failures with SQL larger than the WebAssembly stack (#482, #639).
• Free statement iterator resources when a for...of loop exits early (#457, #632).
• Reset the worker database after close so subsequent requests can initialize a fresh database (#638).
• Update Emscripten to 6.0.12, development tooling, CI actions, documentation, and browser dependencies (#637).
• Retain npm trusted publishing with provenance, and retry transient SQLite source download failures.

Node.js users need Node.js 18.3 or newer. WebAssembly support is required for the default and inline builds.

Full changes: sql-js/sql.js@v1.14.2...v1.15.0

Commits

• 2824d38 Bump version to 1.15.0
• 8dae09f build: retry transient SQLite source download failures
• 787e8ec ci(release): switch npm publish to trusted publishing
• 761091a fix: free StatementIterator resources on early loop exit (#457) (#632)
• 83331b5 Preserve embedded NUL characters in TEXT values (#634)
• 1681c5c build: update SQLite, compiler, tooling, CI, and browser dependencies (#637)
• cba5a0f fix: allocate SQL on the heap in Database.run and Database.prepare (#639)
• 07d3880 fix: reset worker database reference after close (#638)
• 0568ac9 Merge pull request #636 from sql-js/deprecate-asm-inline-wasm
• da30e96 Remove automated coverage of deprecated asm.js builds
• Additional commits viewable in compare view

Updates @types/node from 26.5.1 to 26.6.5

Commits

• See full diff in compare view

Updates mocha from 12.0.1 to 12.0.3

Release notes

Sourced from mocha's releases.

v12.0.3

12.0.3 (2026-10-01)

🩹 Fixes

• keep watching when the last test file is removed (#6355) (921c161)
• show require() error on unsupported directory import (#6354) (a68344f)
• support --X one-char aliases (#6391) (1227939)

📚 Documentation

• refresh help output, fix stale links (#6357) (bb2e69a)

🧹 Chores

• add --import=tsx integration test (#6356) (3382fdd)
• touch a new file without stamping it afterwards (#6349) (d59467a)

v12.0.2

12.0.2 (2026-09-17)

🩹 Fixes

• fail nested tests on beforeEach failure (#6292) (a75b43b)
• give CLI reporter-option precedence over config file (#6331) (571110f)
• propagate spec file path on parallel worker death (#6268) (55a544a)
• use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
• watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

• add remaining external services (#6316) (bfe0b5d)
• update copyright year, holder, and URLs (#6303) (288c075)

🧹 Chores

• add "stale branch" workflow (#6315) (ad17f9f)
• add dependency conflict detection workflow (#6246) (ef0ae32)
• add folder for reproducing issues (#6330) (6728030)
• add stale triage reminder for unreviewed issues (#6314) (ee35133)
• auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
• convert file-unloader to ESM (#6294) (dc73f4c)
• deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
• deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)

... (truncated)

Changelog

Sourced from mocha's changelog.

12.0.3 (2026-10-01)

🩹 Fixes

• keep watching when the last test file is removed (#6355) (921c161)
• show require() error on unsupported directory import (#6354) (a68344f)
• support --X one-char aliases (#6391) (1227939)

📚 Documentation

• refresh help output, fix stale links (#6357) (bb2e69a)

🧹 Chores

• add --import=tsx integration test (#6356) (3382fdd)
• touch a new file without stamping it afterwards (#6349) (d59467a)

12.0.2 (2026-09-17)

🩹 Fixes

• fail nested tests on beforeEach failure (#6292) (a75b43b)
• give CLI reporter-option precedence over config file (#6331) (571110f)
• propagate spec file path on parallel worker death (#6268) (55a544a)
• use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342) (a652ff5)
• watch existing dirs so first run starts armed (#6263) (f5c8aca)

📚 Documentation

• add remaining external services (#6316) (bfe0b5d)
• update copyright year, holder, and URLs (#6303) (288c075)

🧹 Chores

• add "stale branch" workflow (#6315) (ad17f9f)
• add dependency conflict detection workflow (#6246) (ef0ae32)
• add folder for reproducing issues (#6330) (6728030)
• add stale triage reminder for unreviewed issues (#6314) (ee35133)
• auto-remove "waiting for author" label on author activity (#6213) (dbd4322)
• convert file-unloader to ESM (#6294) (dc73f4c)
• deps: update dependency @​playwright/test to v1.63.0 (#6299) (931baa5)
• deps: update dependency eslint to v10.10.0 (#6296) (3cb22d1)
• deps: update dependency knip to v6.35.0 (#6324) (a2416af)
• deps: update octoguide/bot action to v0.23.0 (#6304) (bbe5a27)

... (truncated)

Commits

• 51a0cc5 chore(main): release 12.0.3 (#6353)
• 1227939 fix: support --X one-char aliases (#6391)
• bb2e69a docs: refresh help output, fix stale links (#6357)
• 921c161 fix: keep watching when the last test file is removed (#6355)
• 3382fdd test: add --import=tsx integration test (#6356)
• a68344f fix: show require() error on unsupported directory import (#6354)
• d59467a test: touch a new file without stamping it afterwards (#6349)
• 70db1c7 chore(main): release 12.0.2 (#6300)
• 571110f fix: give CLI reporter-option precedence over config file (#6331)
• a652ff5 fix: use find-up-simple to workaround ERR_PACKAGE_PATH_NOT_EXPORTED (#6342)
• Additional commits viewable in compare view

Updates ovsx from 1.2.0 to 1.3.0

Release notes

Sourced from ovsx's releases.

CLI v1.3.0

Added

• Add --follow-symlinks to publish, forwarding vsce's option of the same name so that the file walk recurses into symlinked directories instead of packing each symlink as a file. Needed for a node_modules assembled out of symlinks, as pnpm's is (#368)
• Add search command to search the registry for extensions, mirroring the web UI's search: --category, --target, --sort-by and --sort-order narrow the query, --size and --offset page through the results, and --json prints the registry's raw response (#2154)
• Add list command to print the extensions a namespace holds, sorted by name so the output stays stable across registries, with --json for the raw namespace metadata (#2154)
• Add show command to print an extension's metadata, mirroring vsce show: identity, publisher, rating, notices and a version history listing each version's target platforms (#2149). namespace.extension@version reports a single version, --target scopes the report to one target platform, --all-versions lists every published version instead of the most recent few, and --json prints the registry's raw metadata
• Add unpublish command to delete an extension or some of its versions, mirroring vsce unpublish (#1958); requires a registry running version 1.2.0 or later, which unpublish checks for before deleting
• publish checks the packaged extension's size against the limit reported by the registry's /api/version endpoint before uploading, instead of failing only after the upload completes (#1953)
• Add verify command to check a downloaded .vsix package's signature against the registry's public key, mirroring vsce verify-signature (#993)
• Add verify-signature command, verifying an already-extracted package/manifest/signature file trio entirely offline (no registry involved), matching vsce verify-signature's own command shape (#993)

Fixed

• Error messages naming a URL no longer include its query string, which for createNamespace, verifyPat, publish and delete carried the personal access token straight to stderr and into CI logs (#2186)

• A connection lost after a JSON response has started no longer leaves the command waiting on a body that is not coming: the response's own error is now what settles the request, so it fails with the reset rather than hanging (#2186)

• Requests now give up after 30 seconds without progress instead of hanging indefinitely when a server accepts a connection and then says nothing. OVSX_TIMEOUT overrides the duration in milliseconds and OVSX_TIMEOUT=0 disables it; it measures inactivity, so a large extension downloading slowly is unaffected, and it covers the trusted-publishing ID token request as well as the registry's own (#2186)

• Fix downloads that could be read before they were written. download resolved when the response ended rather than when the file was closed, and a write stream opens and flushes asynchronously, so a caller reading the path immediately afterwards could find the file empty or absent - which verify did, intermittently failing to read the public key it had just fetched. A failed download no longer touches the target path: the body is written beside it and renamed into place only once it has arrived whole, so a 404 or a dropped connection leaves what was there alone. A connection dropped mid-download now rejects rather than leaving the caller waiting forever (#2185)

Changed

• createNamespace, verifyPat, publish and delete now send the personal access token primarily via an Authorization: Bearer header (or, when OVSX_USERNAME/OVSX_PASSWORD are set, an X-OpenVSX-Token header, since Authorization is then already in use for Basic auth to a fronting proxy), moving away from a token query parameter that gets recorded in server and reverse-proxy access logs. The CLI checks the registry's reported version (/api/version) and only still sends the token as a query parameter, alongside the header, when talking to a registry older than 1.3.0, i.e. one that predates header support - including one whose version can't be determined at all, which is treated as too old rather than assumed to be caught up; on 1.3.0 and later the header is all it sends (#1344)
• publish --trusted-publishing retries the token exchange when the registry answers that it could not verify the ID token (502, 503, 504), rather than failing the build on a blip reaching the identity provider. A refusal is never retried
• publish --trusted-publishing requests a new token and retries once when the registry refuses the one it was publishing with. The issued token is short-lived and shared by every target platform of a release, so publishing a wide fan-out of large packages could outlive it and fail partway through. Targets that are refused together share one new token, and a token supplied with --pat is never retried
• Bump minimum supported Node.js version to 22, matching the webui component

Dependencies

• Bump fast-uri from 3.1.5 to 3.1.7
• Bump qs from 6.15.2 to 6.16.0
• Bump @​humanfs/node from 0.16.6 to 0.16.8
• Bump js-yaml from 4.3.1 to 4.3.2
• Bump nanoid from 3.3.16 to 3.3.18

Frontend Library v1.3.0

Added

• Add a /publish page and turn the navbar's Publish button into a drop target: a file drag anywhere in the app turns the button into a drop area, and every .vsix package dropped on it — or on the publish page's own drop area — is queued and uploaded straight away, with no confirmation dialog. The page shows the queue as a line of extension cards — a skeleton while a package uploads, the real card once the registry accepts it, labelled with whatever the registry did with it — and keeps polling anything left under review or still missing its icon
• Export PublishButton, which carries the publish link, its p shortcut and the app's .vsix drop target in one component, so a deployment with its own menu content keeps drag-and-drop publishing
• Add a "Data Consistency" page to the admin dashboard (#1622): a live overview of every registered consistency check's finding count, with actions to refresh it and to fix findings one at a time or all at once
• Show a "Namespace not verified" state on an extension card when it can't be activated because its namespace already exists in a referenced external gallery and hasn't been verified, in both the "My Extensions" and namespace member extension lists. The card keeps its colour and takes a warning-toned frame and icon, since this is the publisher's to fix rather than an extension that is simply switched off
• Show a warning notice with a claim action wherever an unverified namespace is holding something back — the extension settings page when the extension has a namespace ownership conflict, and the namespace settings page for any unverified namespace — making clear the namespace must be claimed (verified) first. The action is the deployment's configured elements.claimNamespace, falling back to the namespace access documentation when none is configured. The admin dashboard's extension and namespace views show the same explanation without the claim action, since claiming is the publisher's action to take, not an admin's on someone else's behalf
• Add a "Search Index" page to the admin dashboard: which engine answers searches, how many extensions the index holds against how many it is built from, and a button to rebuild it where there is an index to rebuild. The two counts sit side by side because an index that has quietly lost entries answers searches perfectly well, just with nothing in them, which is indistinguishable from an empty registry unless both numbers are visible at once
• Mark a version that was published through a trusted publishing workflow with an icon next to "Published by" on the extension detail page, linking to the deployment's trusted publishing documentation. The default deployment points that link at the Trusted Publishing wiki page
• Add a Pill component — the clickable glass pill the category pills are built on, now usable on its own — and extract the MonoSlash, glassSurface and compactControl page primitives out of the search field, the pills and the search header
• Add userLoading to MainContext, so custom pages can tell "not logged in" from "still resolving the user"
• Add a userMenuContent slot to PageSettings.elements: extra entries for the logged-in account menu, rendered above the admin entry. The slot receives a MenuEntry component to build entries with, so each entry is styled by the menu it appears in — the desktop and mobile menus style theirs differently, and a consumer cannot match both on its own
• Add an adminPages slot to PageSettings.elements: extra admin dashboard pages, each declaring a name, icon, optional description and optional category, and each appearing in the side panel, as a card on the dashboard overview and as a route. Contributions are additive — a category name matching a built-in group appends to it, and a page whose path would shadow a built-in one is ignored
• Widen the published API for consumers building their own pages: the request layer (sendRequest, sendNonRetriableRequest, ErrorResponse, controllerFromSignal), MainContext, AppProviders, NotFound, createDefaultTheme with the MONO_FONT/NAVBAR_HEIGHT tokens, the createRoute/createAbsoluteURL/addQuery/formatCompactNumber/toRelativeTime utils, the useDebouncedCallback and useGridCursor hooks, the navbar-chrome, search-focus and page-search-bar hooks, the category icon helpers, ExtensionDetailRoutes, and the itemIcon/MenuItemText building blocks for userMenuContent entries

... (truncated)

Changelog

Sourced from ovsx's changelog.

[1.3.0] - 2026-10-16

Changed

• publish checks a package against the size limit that applies to its own namespace, which a size override can raise above the registry default, and refuses an oversized upload before sending it. Against a registry older than 1.3.0, which cannot report that limit, it warns against the default and publishes anyway; if a registry that should be able to report it does not answer, it says the check did not happen rather than passing silently (#2129)

Fixed

• --version reads the version from package.json at runtime instead of a generated src/version.ts, so it can no longer report a stale version (#2295)
• publish now deletes the .vsix it packages into the temp directory once publishing finishes or fails, instead of leaving one behind per package and target (#2286)
• Drop the X-OpenVSX-Token header, which carries the personal access token when --username/--password are set, on a redirect to another origin, as is done for Authorization (#2309)
• A request with a body that is redirected with 301/302/303 now fails with an error naming the redirect target, instead of being resent as a GET without its body (#2309)
• Trusted publishing's OIDC ID token request now uses the registry client's request handling: it follows redirects (dropping the runner token on a redirect to another origin) and reports the token service's error message instead of only its status (#2322)
• An HTML page in a successful response (any <!doctype html> casing, or a text/html Content-Type) now fails with an error naming the status, instead of printing the raw HTML or a JSON SyntaxError (#2326)
• An error response whose JSON body starts with whitespace now reports the server's message instead of only its status (#2326)

Dependencies

• Bump commander from 6.2.1 to 14.0.3; a command given more arguments than it takes now fails instead of ignoring the extras (#2294)
• Bump @​vscode/vsce from 3.7.1 to 4.0.0 (#2288)
• Bump vitest from 4.1.11 to 5.0.3, adding vite as a direct dev dependency - vitest 5 no longer bundles it, only requires it as a peer (#2291)
• Remove leven; the command-suggestion distance check now uses a vendored Levenshtein implementation, the same way @vscode/vsce itself replaced its own leven dependency in 4.0.0 (#2290)
• Remove tmp; temporary file names are now generated with crypto.randomUUID (#2284)
• Remove follow-redirects; requests use node:http/node:https and the registry client follows redirects itself (#2309)
• Bump ip-address from 10.4.0 to 10.7.2 (#2264)
• Bump brace-expansion to 1.1.21, 2.1.7, 5.0.12
• Bump markdown-it from 14.2.0 to 14.3.2 (#2281)

Commits

• e0b958f chore: prepare for cli 1.3.0 release
• 106e81b docs: tidy the 1.3.0 release notes (#2344)
• 5d26c73 docs: use Keep a Changelog headings in all change logs (#2343)
• 5f2de6f fix(cli): handle HTML and whitespace-prefixed JSON responses (#2326)
• fc539ff fix(cli): share registry request handling with OIDC (#2322)
• 418cf1a chore(cli): use stream/consumers buffer() in readZip (#2319)
• 729edb9 chore(cli): replace util fs callback wrappers with fs.promises (#2310)
• bf689ad chore(cli): replace follow-redirects with node:http (#2309)
• f8b2c5c chore(deps): bump commander from 6.2.1 to 14.0.3 in cli (#2294)
• a81414a fix(cli): read the version from package.json at runtime (#2295)
• Additional commits viewable in compare view

Install script changes

This version modifies prepare script that runs during installation. Review the package contents before updating.

Updates playwright-core from 1.63.0 to 1.64.1

Release notes

Sourced from playwright-core's releases.

v1.64.1

Bug Fixes

• #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
• #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits

• cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
• 866cbb8 chore: mark v1.64.1 (#43354)
• 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
• 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
• 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
• 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
• e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
• f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
• e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
• d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
• Additional commits viewable in compare view

Updates tsx from 4.23.13 to 4.23.15

Release notes

Sourced from tsx's releases.

v4.23.15

4.23.15 (2026-09-20)

Bug Fixes

• exclude bare builtins from namespace inheritance (38e1588)
• expose require.cache and require.extensions to tsImport CommonJS modules (2da3407)
• make namespaced register() overloads portable for declaration emit (562c434)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.14

4.23.14 (2026-09-20)

Bug Fixes

• restore the CJS bridge namespace for Node 24 require(esm) under tsImport() (#802) (6e5236b)

---

This release is also available on:

• npm package (@​latest dist-tag)

Commits

• ca66105 test: fix drive-less file URLs in ESM resolver fixtures
• 2da3407 fix: expose require.cache and require.extensions to tsImport CommonJS modules
• 38e1588 fix: exclude bare builtins from namespace inheritance
• 562c434 fix: make namespaced register() overloads portable for declaration emit
• edfb1f0 build: upgrade pkgroll and externalize CJS loader reference
• 70e7828 test: upgrade tinyspy for disposable API
• 9ed2022 ci: avoid duplicate release notifications
• 872e77f refactor: use disposables for cleanup
• 6e5236b fix: restore the CJS bridge namespace for Node 24 require(esm) under tsImport...
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: a36ba559-c0da-4f24-a3b7-dd9c99c011e2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
sq-lite-explorer	Ready	Preview	Oct 19, 2026 10:23pm UTC