Bump the routine-npm-updates group with 17 updates by dependabot[bot] · Pull Request #21 · HaithamAlMaamari/tablevote

dependabot · 2026-09-01T09:55:19Z

Bumps the routine-npm-updates group with 17 updates:

Package	From	To
express-rate-limit	`8.6.1`	`8.7.0`
react-router	`8.3.0`	`8.3.1`
sonner	`2.0.7`	`2.0.8`
zod	`4.4.3`	`4.5.2`
@axe-core/playwright	`4.12.1`	`4.13.0`
@types/react	`19.2.17`	`19.2.18`
@types/react-dom	`19.2.3`	`19.2.5`
@vitejs/plugin-react	`6.0.5`	`6.1.1`
@vitest/coverage-v8	`4.1.10`	`4.1.11`
esbuild	`0.28.1`	`0.28.2`
eslint	`10.8.0`	`10.9.1`
eslint-plugin-react-refresh	`0.5.3`	`0.5.5`
postcss	`8.5.25`	`8.5.26`
tsx	`4.23.1`	`4.23.12`
typescript-eslint	`8.65.0`	`8.68.0`
vite	`8.2.0`	`8.2.2`
vitest	`4.1.10`	`4.1.11`

Updates express-rate-limit from 8.6.1 to 8.7.0

Release notes

Sourced from express-rate-limit's releases.

v8.7.0

You can view the changelog here.

v8.6.2

You can view the changelog here.

Commits

48db09e 8.7.0
dce5871 v8.7.0 changelog
2f08044 Add inspect.software health badge (#673)
a29757c feat: add retryAfter option (#661)
146e88b chore: rename license
5cfb8e8 ci: drop top-level id-token: write from the workflow token (#676)
062bbdd fix: re-wrap license.md so GitHub recognizes it as MIT (#675)
514772d chore(deps-dev): bump mintlify in the development-dependencies group (#674)
4f06c8a chore(deps-dev): bump the development-dependencies group with 2 updates (#671)
83356a5 chore(deps): bump ip-address from 10.4.0 to 10.5.0 (#672)
Additional commits viewable in compare view

Updates react-router from 8.3.0 to 8.3.1

Release notes

Sourced from react-router's releases.

v8.3.1

See the changelog for release notes: https://github.com/remix-run/react-router/blob/main/CHANGELOG.md#v831

Changelog

Sourced from react-router's changelog.

v8.3.1

Patch Changes

Fix Expected fetcher: <key> error thrown on navigation when a fetcher is aborted during its post-action revalidation (#15365)

Fix lazy route discovery caching a path as discovered when the triggering navigation was aborted after the manifest response settled but before the route tree was patched, which permanently (for the session) shadowed the real route behind a catch-all or produced 404s on every subsequent visit (#15399)

Improve route matching performance for long paths (#15417)

Improve validation of action request origins (#15419)

Fix <ScrollRestoration> leaving history.scrollRestoration set to "auto" after a bfcache restore, which let the browser restore scroll on subsequent history traversals before the destination route had rendered (#15397)

Properly respect the relative option in useSubmit/fetcher.submit when resolivng the action path (#15400)

Add additional URL validation on client side navigations/redirects (#15445)

Commits

da2a0f0 Release v8.3.1 (#15368)
917e6fd fix(fog-of-war): don't cache aborted lazy route discoveries as discovered (#1...
2e0bf72 Validate client-side navigation targets (#15445)
f45d4ca Revert "fix: normalize control characters in relative URLs (#15416)" (#15442)
c091832 fix: validate schemeful action origins (#15419)
308d206 fix: improve matching perf (#15417)
36bdbeb fix: normalize control characters in relative URLs (#15416)
801e2ae fix(react-router): re-enable manual scroll restoration after a bfcache restor...
5e98140 fix: honor the relative option in useSubmit and fetcher.submit (#15400)
5843d38 refactor(router): use definite assignment assertions in createDeferred (#15396)
Additional commits viewable in compare view

Updates sonner from 2.0.7 to 2.0.8

Release notes

Sourced from sonner's releases.

v2.0.8

What's Changed

Added support for custom aria labels by @hirotomoyamada in emilkowalski/sonner#704

Fixed handling when hotkey is an empty array by @hirotomoyamada in emilkowalski/sonner#703

fix: keep the toaster as top layer when react-aria modal is open by @sadeghbarati in emilkowalski/sonner#699

fix: format by @WuMingDao in emilkowalski/sonner#707

fix: add missing safari prefix by @emilkowalski in emilkowalski/sonner#710

Fix event listener removal in hooks.tsx by @VishwaGauravIn in emilkowalski/sonner#711

Fix dismiss for custom toast by @reegodev in emilkowalski/sonner#717

Use variables in close button colors instead of hardcoded values by @faroukfaiz10 in emilkowalski/sonner#726

Fix a batch of reported issues by @emilkowalski in emilkowalski/sonner#777

New Contributors

@hirotomoyamada made their first contribution in emilkowalski/sonner#704

@sadeghbarati made their first contribution in emilkowalski/sonner#699

@WuMingDao made their first contribution in emilkowalski/sonner#707

@VishwaGauravIn made their first contribution in emilkowalski/sonner#711

@reegodev made their first contribution in emilkowalski/sonner#717

@faroukfaiz10 made their first contribution in emilkowalski/sonner#726

Full Changelog: emilkowalski/sonner@v2.0.7...v2.0.8

Commits

6739aca v2.0.8
ecce184 Fix a batch of reported issues (#777)
45d8940 Use variables in close button colors instead of hardcoded values (#726)
fe51da1 Fix dismiss for custom toast (#717)
c2d6990 fix: event listener removal in hooks.tsx (#711)
5caadb1 Add safari prefix (#710)
ea3410f fix: format (#707)
a685ffc fix: keep the toaster as top layer when react-aria modal is open (#699)
7760223 fix(index.tsx): ensure hotkey array is not empty before checking (#703)
8c0ce1e feat(toaster): add support for custom aria labels (#704)
See full diff in compare view

Updates zod from 4.4.3 to 4.5.2

Release notes

Sourced from zod's releases.

v4.5.2

Commits:

a354314ac04fdd5484aa62dd5c3a4b553211a0e4 fix(docs): keep blog posts out of the docs collection (#6484)

d378c42aff6869f0929058a7923cd775880f5c4c ci: drop canary publishing from the release workflow (#6487)

212b941791e7faae078e17645eb612824fd8f79a fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (#6488)

e7576f542a7bc7ef3cc5eeec237714fd0e6b6e98 docs(blog): let the page show through the navbar in dark mode (#6489)

fedb06fafe33a66ce0b5c236ad2557e0a5a170fe fix(docs): match the blog TOC hover bar to the 2px active indicator

6c932fcb2eea6eb671710ea058ca9fdc382ada89 chore: bump devcontainer image to Node 24 (#6470)

6635d9dd367a664109de83c021995821f48efa29 docs(blog): soften the "method memoization" attribution

019ae299cc75daa132bf1acf59086a520abf6b85 fix(docs): drop ISR on the docs route so the home page hydrates

652bb438aa4c626c1cd7948c6849c4691239fca7 chore(docs): drop the scroll log from the route-change scroller

571c8e8a3d73b4305f4abfdd6977773cc12f2bf5 fix(docs): render blog tabs with the stock fumadocs tab card

9a193aa24b4efa3b315b91d4c56c8bc385b8513f 4.5.2

v4.5.1

Commits:

2e862dbf89da2835e5206a8fd3d3be61afe3cf7f ci: gate the GitHub release and JSR publish on the version being live on npm

8e03380510db36fa6fda979fc78a375fdea8021c 4.5.1

v4.5.0

Zod 4.5 is now available.
npm install zod@latest
At a glance:

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADmhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the flagship feature of Zod 4.5

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADChttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — 12–19 digits plus Luhn checksum

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADshttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — the multi-property counterpart to z.property()

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD/https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADPhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADxhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADchttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADphttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADrhttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD

https://github.com/colinhacks/zod/blob/HEAD[https://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEAD.https://github.com/colinhacks/zod/blob/HEADvhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD:https://github.com/colinhacks/zod/blob/HEAD https://github.com/colinhacks/zod/blob/HEADbhttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADohttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADnhttps://github.com/colinhacks/zod/blob/HEAD`https://github.com/colinhacks/zod/blob/HEAD]https://github.com/colinhacks/zod/blob/HEAD(https://github.com/colinhacks/zod/blob/HEAD#https://github.com/colinhacks/zod/blob/HEADzhttps://github.com/colinhacks/zod/blob/HEADvhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADlhttps://github.com/colinhacks/zod/blob/HEADihttps://github.com/colinhacks/zod/blob/HEADdhttps://github.com/colinhacks/zod/blob/HEADahttps://github.com/colinhacks/zod/blob/HEADthttps://github.com/colinhacks/zod/blob/HEADehttps://github.com/colinhacks/zod/blob/HEAD)https://github.com/colinhacks/zod/blob/HEAD — a fast-path to verify input validity without a full parse (up to 16x faster on invalid data)

9x reduction in memory footprint

New locales: Bengali (bn), Central Kurdish (ckb), Hindi (hi), Kannada (kn), Norwegian Nynorsk (nn), Brazilian Portuguese (pt-BR), Slovak (sk), Turkmen (tk)

z.compile()

You can now pre-compile any Zod schema using z.compile(schema). This dramatically speeds up parsing performance.
import * as z from "zod";
const Player = z.object({
username: z.string(),
bio: z.string(),
xp: z.number(),
// ...20 more properties...
</tr></table>

... (truncated)

Commits

9a193aa 4.5.2
571c8e8 fix(docs): render blog tabs with the stock fumadocs tab card
652bb43 chore(docs): drop the scroll log from the route-change scroller
019ae29 fix(docs): drop ISR on the docs route so the home page hydrates
6635d9d docs(blog): soften the "method memoization" attribution
6c932fc chore: bump devcontainer image to Node 24 (#6470)
fedb06f fix(docs): match the blog TOC hover bar to the 2px active indicator
e7576f5 docs(blog): let the page show through the navbar in dark mode (#6489)
212b941 fix(v4): let a prototype method getter answer a bare call so vi.spyOn works (...
d378c42 ci: drop canary publishing from the release workflow (#6487)
Additional commits viewable in compare view

Updates @axe-core/playwright from 4.12.1 to 4.13.0

Release notes

Sourced from @axe-core/playwright's releases.

Release 4.13.0

What's Changed

ci: use pat instead of github token by @Garbee in dequelabs/axe-core-npm#1334

chore: bump nyc from 17.1.0 to 18.0.0 by @dependabot[bot] in dequelabs/axe-core-npm#1311

chore: increase timeout for axe-core update by @Garbee in dequelabs/axe-core-npm#1354

chore: pin node by @Garbee in dequelabs/axe-core-npm#1355

test: fix webdriverio esmTest.mjs by @straker in dequelabs/axe-core-npm#1356

chore: disable dependabot rebase strategy by @Garbee in dequelabs/axe-core-npm#1344

chore: bump actions/checkout from 6 to 6.0.2 in the gha-low-risk group by @dependabot[bot] in dequelabs/axe-core-npm#1357

ci: increase timeout for axe-core update by @Garbee in dequelabs/axe-core-npm#1360

chore: exclude test/release from npm workspaces by @Garbee in dequelabs/axe-core-npm#1361

chore: bump axios from 1.14.0 to 1.17.0 by @dependabot[bot] in dequelabs/axe-core-npm#1358

chore: merge master into develop by @michael-siek in dequelabs/axe-core-npm#1362

chore: declare @eslint/js and group eslint deps for dependabot by @Garbee in dequelabs/axe-core-npm#1348

chore: bump actions/checkout from 6.0.2 to 6.0.3 in the gha-low-risk group by @dependabot[bot] in dequelabs/axe-core-npm#1363

chore: group browser-driver and jest deps for dependabot by @Garbee in dequelabs/axe-core-npm#1365

chore: bump flatted from 3.3.1 to 3.4.2 by @dependabot[bot] in dequelabs/axe-core-npm#1301

chore: bump handlebars from 4.7.8 to 4.7.9 by @dependabot[bot] in dequelabs/axe-core-npm#1305

chore: bump fast-xml-parser from 5.5.1 to 5.8.0 by @dependabot[bot] in dequelabs/axe-core-npm#1325

chore: bump lodash from 4.17.21 to 4.18.1 by @dependabot[bot] in dequelabs/axe-core-npm#1337

chore: bump ip-address and socks by @dependabot[bot] in dequelabs/axe-core-npm#1339

chore: bump fast-xml-builder from 1.1.0 to 1.2.0 by @dependabot[bot] in dequelabs/axe-core-npm#1342

chore: bump basic-ftp from 5.2.0 to 5.3.1 by @dependabot[bot] in dequelabs/axe-core-npm#1341

chore: bump qs from 6.14.0 to 6.15.2 by @dependabot[bot] in dequelabs/axe-core-npm#1349

chore: bump tmp from 0.2.5 to 0.2.7 by @dependabot[bot] in dequelabs/axe-core-npm#1350

chore: bump @babel/plugin-transform-modules-systemjs from 7.29.0 to 7.29.7 by @dependabot[bot] in dequelabs/axe-core-npm#1343

chore: bump undici from 6.23.0 to 6.26.0 by @dependabot[bot] in dequelabs/axe-core-npm#1366

chore: bump the selenium group with 2 updates by @dependabot[bot] in dequelabs/axe-core-npm#1369

chore: bump lint-staged from 16.3.2 to 17.0.7 by @dependabot[bot] in dequelabs/axe-core-npm#1375

chore: bump sinon from 21.0.1 to 22.0.0 by @dependabot[bot] in dequelabs/axe-core-npm#1374

chore: bump @playwright/test from 1.58.2 to 1.60.0 in the playwright group by @dependabot[bot] in dequelabs/axe-core-npm#1371

feat: Update axe-core to v4.12.1 by @attest-team-ci in dequelabs/axe-core-npm#1378

chore: RC v4.12.0 by @attest-team-ci in dequelabs/axe-core-npm#1381

chore: RC v4.12.1 by @attest-team-ci in dequelabs/axe-core-npm#1391

chore: release v4.12.1 by @axe-core in dequelabs/axe-core-npm#1393

chore: merge master into develop by @attest-team-ci in dequelabs/axe-core-npm#1394

chore: bump @sigstore/core from 3.1.0 to 3.2.1 by @dependabot[bot] in dequelabs/axe-core-npm#1395

chore: bump axios from 1.17.0 to 1.18.1 by @dependabot[bot] in dequelabs/axe-core-npm#1400

chore: bump rollup from 4.46.2 to 4.62.2 by @dependabot[bot] in dequelabs/axe-core-npm#1402

chore: bump undici from 6.26.0 to 6.28.0 by @dependabot[bot] in dequelabs/axe-core-npm#1409

chore: bump ip-address from 10.2.0 to 10.4.0 by @dependabot[bot] in dequelabs/axe-core-npm#1408

ci: remove scheduled trigger from update-axe-core workflow by @Garbee in dequelabs/axe-core-npm#1411

feat: update axe-core to v4.13.0 by @axe-core in dequelabs/axe-core-npm#1413

chore: RC v4.13.0 by @attest-team-ci in dequelabs/axe-core-npm#1414

chore: release v4.13.0 by @axe-core in dequelabs/axe-core-npm#1416

Full Changelog: dequelabs/axe-core-npm@v4.11.3...v4.13.0

Changelog

Sourced from @axe-core/playwright's changelog.

4.13.0 (2026-08-10)

Features

Update axe-core to v4.12.1 (#1378) (4263054)

update axe-core to v4.13.0 (#1413) (399c5d7), closes #1412

Commits

See full diff in compare view

Updates @types/react from 19.2.17 to 19.2.18

Commits

See full diff in compare view

Updates @types/react-dom from 19.2.3 to 19.2.5

Commits

See full diff in compare view

Updates @vitejs/plugin-react from 6.0.5 to 6.1.1

Release notes

Sourced from @vitejs/plugin-react's releases.

plugin-react@6.1.1

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:
npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Changelog

Sourced from @vitejs/plugin-react's changelog.

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Recoverable React Compiler diagnostics are no longer logged by default. Set compiler.logDiagnostics to true to log them through Vite. Fatal diagnostics are always logged and fail the transform.

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

The React Compiler transform was using the top-level sourcemap option instead of the environment sourcemap option. This caused a problem when the experimental builder.sharedPlugins was enabled.

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

Add experimental native React Compiler support.

You can use it by installing oxc-transform-react and enabling it via the compiler option:
npm install -D oxc-transform-react
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
export default defineConfig({
plugins: [
react({ compiler: true })
]
})

Commits

04cac50 release: plugin-react@6.1.1 (#1440)
82d35ab fix(react): respect environment sourcemap option when builder.sharedPlugins...
397e847 fix(react): make logging diagnostics an opt-in for React Compiler (#1431)
61006e6 fix(deps): update all non-major dependencies (#1433)
e2a649c chore: use deps.neverBundle instead of external in tsdown config (#1430)
fb2d6f3 fix(deps): update all non-major dependencies (#1427)
39b3173 release: plugin-react@6.1.0 (#1428)
f1340b0 feat(react): add native React Compiler support (#1419)
9ab698e fix(deps): update all non-major dependencies (#1375)
See full diff in compare view

Updates @vitest/coverage-v8 from 4.1.10 to 4.1.11

Release notes

Sourced from @vitest/coverage-v8's releases.

v4.1.11

🐞 Bug Fixes

Revive global concurrency limit for test lifecycle [backport to v4] - by @sheremet-va and @hi-ogawa in vitest-dev/vitest#10992 (5146d)

browser:

Encode iframeId in tester iframe URL [backport to v4] - by @sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)

Trigger playwright/chromium gc on lower disk availability [backport to v4] - by @hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)

mocker:

Restrict redirect mocks to the fs allowlist [backport to v4] - by @sheremet-va in vitest-dev/vitest#10974 (fe5a1)

View changes on GitHub

Commits

9bd8d46 chore: release v4.1.11 (#10995)
See full diff in compare view

Updates esbuild from 0.28.1 to 0.28.2

Release notes

Sourced from esbuild's releases.

v0.28.2
Fix tree shaking bug due to TypeScript import alias (#4507)

This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:
import Base from './dep.js';
import Alias = Base.SomeType;
Fix CSS minification bug involving & (#4497)

This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:
/* Original code */
.a .b {
 & .b:not(& .c) {
 color: red;
 }
}
/* Old output (with --minify) */
.a .b{.b:not(& .c){color:red}}
/* New output (with --minify) */
.a .b{& .b:not(& .c){color:red}}
This should match yes but not no. The old output incorrectly matched both.
Avoid overwriting input files without --allow-overwrite (#4484)

For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

Fix incorrect code generated when using top-level await (#4498)

Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.
Fix a minification bug with lowered logical assignment operators (#4508)

This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:
// Original code
function foo() {
 let x
 bar(x ||= {})

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.28.2

Fix tree shaking bug due to TypeScript import alias (

Bumps the routine-npm-updates group with 17 updates: | Package | From | To | | --- | --- | --- | | [express-rate-limit](https://github.com/express-rate-limit/express-rate-limit) | `8.6.1` | `8.7.0` | | [react-router](https://github.com/remix-run/react-router/tree/HEAD/packages/react-router) | `8.3.0` | `8.3.1` | | [sonner](https://github.com/emilkowalski/sonner) | `2.0.7` | `2.0.8` | | [zod](https://github.com/colinhacks/zod) | `4.4.3` | `4.5.2` | | [@axe-core/playwright](https://github.com/dequelabs/axe-core-npm) | `4.12.1` | `4.13.0` | | [@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react) | `19.2.17` | `19.2.18` | | [@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom) | `19.2.3` | `19.2.5` | | [@vitejs/plugin-react](https://github.com/vitejs/vite-plugin-react/tree/HEAD/packages/plugin-react) | `6.0.5` | `6.1.1` | | [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) | `4.1.10` | `4.1.11` | | [esbuild](https://github.com/evanw/esbuild) | `0.28.1` | `0.28.2` | | [eslint](https://github.com/eslint/eslint) | `10.8.0` | `10.9.1` | | [eslint-plugin-react-refresh](https://github.com/ArnaudBarre/eslint-plugin-react-refresh) | `0.5.3` | `0.5.5` | | [postcss](https://github.com/postcss/postcss) | `8.5.25` | `8.5.26` | | [tsx](https://github.com/privatenumber/tsx) | `4.23.1` | `4.23.12` | | [typescript-eslint](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/typescript-eslint) | `8.65.0` | `8.68.0` | | [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite) | `8.2.0` | `8.2.2` | | [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest) | `4.1.10` | `4.1.11` | Updates `express-rate-limit` from 8.6.1 to 8.7.0 - [Release notes](https://github.com/express-rate-limit/express-rate-limit/releases) - [Commits](express-rate-limit/express-rate-limit@v8.6.1...v8.7.0) Updates `react-router` from 8.3.0 to 8.3.1 - [Release notes](https://github.com/remix-run/react-router/releases) - [Changelog](https://github.com/remix-run/react-router/blob/main/packages/react-router/CHANGELOG.md) - [Commits](https://github.com/remix-run/react-router/commits/react-router@8.3.1/packages/react-router) Updates `sonner` from 2.0.7 to 2.0.8 - [Release notes](https://github.com/emilkowalski/sonner/releases) - [Commits](emilkowalski/sonner@v2.0.7...v2.0.8) Updates `zod` from 4.4.3 to 4.5.2 - [Release notes](https://github.com/colinhacks/zod/releases) - [Commits](colinhacks/zod@v4.4.3...v4.5.2) Updates `@axe-core/playwright` from 4.12.1 to 4.13.0 - [Release notes](https://github.com/dequelabs/axe-core-npm/releases) - [Changelog](https://github.com/dequelabs/axe-core-npm/blob/develop/CHANGELOG.md) - [Commits](https://github.com/dequelabs/axe-core-npm/commits/v4.13.0) Updates `@types/react` from 19.2.17 to 19.2.18 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react) Updates `@types/react-dom` from 19.2.3 to 19.2.5 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom) Updates `@vitejs/plugin-react` from 6.0.5 to 6.1.1 - [Release notes](https://github.com/vitejs/vite-plugin-react/releases) - [Changelog](https://github.com/vitejs/vite-plugin-react/blob/main/packages/plugin-react/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite-plugin-react/commits/plugin-react@6.1.1/packages/plugin-react) Updates `@vitest/coverage-v8` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/coverage-v8) Updates `esbuild` from 0.28.1 to 0.28.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.28.1...v0.28.2) Updates `eslint` from 10.8.0 to 10.9.1 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.0...v10.9.1) Updates `eslint-plugin-react-refresh` from 0.5.3 to 0.5.5 - [Release notes](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/releases) - [Changelog](https://github.com/ArnaudBarre/eslint-plugin-react-refresh/blob/main/CHANGELOG.md) - [Commits](ArnaudBarre/eslint-plugin-react-refresh@v0.5.3...v0.5.5) Updates `postcss` from 8.5.25 to 8.5.26 - [Release notes](https://github.com/postcss/postcss/releases) - [Changelog](https://github.com/postcss/postcss/blob/main/CHANGELOG.md) - [Commits](postcss/postcss@8.5.25...8.5.26) Updates `tsx` from 4.23.1 to 4.23.12 - [Release notes](https://github.com/privatenumber/tsx/releases) - [Changelog](https://github.com/privatenumber/tsx/blob/master/release.config.cjs) - [Commits](privatenumber/tsx@v4.23.1...v4.23.12) Updates `typescript-eslint` from 8.65.0 to 8.68.0 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/typescript-eslint/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.68.0/packages/typescript-eslint) Updates `vite` from 8.2.0 to 8.2.2 - [Release notes](https://github.com/vitejs/vite/releases) - [Changelog](https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md) - [Commits](https://github.com/vitejs/vite/commits/v8.2.2/packages/vite) Updates `vitest` from 4.1.10 to 4.1.11 - [Release notes](https://github.com/vitest-dev/vitest/releases) - [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md) - [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.11/packages/vitest) --- updated-dependencies: - dependency-name: express-rate-limit dependency-version: 8.7.0 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: routine-npm-updates - dependency-name: react-router dependency-version: 8.3.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: sonner dependency-version: 2.0.8 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: zod dependency-version: 4.5.2 dependency-type: direct:production update-type: version-update:semver-minor dependency-group: routine-npm-updates - dependency-name: "@axe-core/playwright" dependency-version: 4.13.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: routine-npm-updates - dependency-name: "@types/react" dependency-version: 19.2.18 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: "@types/react-dom" dependency-version: 19.2.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: "@vitejs/plugin-react" dependency-version: 6.1.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: routine-npm-updates - dependency-name: "@vitest/coverage-v8" dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: esbuild dependency-version: 0.28.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: eslint dependency-version: 10.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: routine-npm-updates - dependency-name: eslint-plugin-react-refresh dependency-version: 0.5.5 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: postcss dependency-version: 8.5.26 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: tsx dependency-version: 4.23.12 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: typescript-eslint dependency-version: 8.68.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: routine-npm-updates - dependency-name: vite dependency-version: 8.2.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates - dependency-name: vitest dependency-version: 4.1.11 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: routine-npm-updates ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Sep 1, 2026

Navigation Menu

Bump the routine-npm-updates group with 17 updates - #21

Bump the routine-npm-updates group with 17 updates#21
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/routine-npm-updates-e0fbb2ccd9

dependabot Bot commented on behalf of github Sep 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

dependabot Bot commented on behalf of github Sep 1, 2026

v8.7.0

v8.6.2

v8.3.1

v8.3.1

Patch Changes

v2.0.8

What's Changed

New Contributors

v4.5.2

Commits:

v4.5.1

Commits:

v4.5.0

z.compile()

Release 4.13.0

What's Changed

4.13.0 (2026-08-10)

Features

plugin-react@6.1.1

Add compiler.logDiagnostics option

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

plugin-react@6.1.0

Add experimental native React Compiler support (#1419)

6.1.1 (2026-08-28)

Add compiler.logDiagnostics option

Respect environment sourcemap option for React Compiler transform when builder.sharedPlugins is enabled (#1439)

6.1.0 (2026-08-19)

Add experimental native React Compiler support (#1419)

v4.1.11

🐞 Bug Fixes

View changes on GitHub

v0.28.2

0.28.2

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

`z.compile()`

Add `compiler.logDiagnostics` option

Respect environment sourcemap option for React Compiler transform when `builder.sharedPlugins` is enabled (#1439)

Add `compiler.logDiagnostics` option

Respect environment sourcemap option for React Compiler transform when `builder.sharedPlugins` is enabled (#1439)