Skip to content

chore(deps-dev): bump the testing group across 1 directory with 4 updates - #113

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/testing-b4ee3c1e73
Open

chore(deps-dev): bump the testing group across 1 directory with 4 updates#113
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/testing-b4ee3c1e73

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 18, 2026 •
edited by github-actions Bot
Loading

Copy link
Copy Markdown
Contributor

Bumps the testing group with 4 updates in the / directory: @playwright/test, @testing-library/user-event, @vitest/coverage-v8 and vitest.

Updates @playwright/test from 1.63.0 to 1.64.1

Release notes

Sourced from @​playwright/test's releases.

v1.64.1

Bug Fixes

  • #43247 [Bug]: _electron.launch intermittently loses a packaged app's first window since 1.64.0
  • #43242 [Regression]: Chromium 155+ aborts a preflighted cross-origin redirect whenever any route is registered (net::ERR_ABORTED)

v1.64.0

🧰 WebMCP

New page.webmcp and frame.webmcp give access to the tools that a page registers through the experimental WebMCP browser API, so you can test them like any other part of your app:

const browser = await chromium.launch({ args: ['--enable-features=WebMCP'] });
const page = await browser.newPage();
await page.goto('https://example.com');
for (const tool of await page.webmcp.tools())
console.log(tool.name, tool.description);
const result = await page.webmcp.callTool('add', { a: 2, b: 40 });
console.log(result.content[0].text); // "42"

Playwright MCP also supports WebMCP by default, with page-defined tools offered to the agent as webmcp_<tool>. Pass --no-webmcp to opt out.

playwright-cli exposes them as well:

playwright-cli webmcp-list
playwright-cli webmcp-call search_catalog --params '{"query":"cats"}'

🎬 Better videos

Videos can now be recorded at a custom frame rate, and the decorations for actions are styled with plain CSS:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
use: {
video: {
mode: 'on',
size: { width: 1920, height: 1080 },
fps: 60,
show: {
actions: {
style: {
point: 'width: 20px; height: 20px; border-radius: 50%; background: red',
</tr></table>

... (truncated)

Commits
  • cfe490d cherry-pick(#43353): docs: release notes for v1.64 Python
  • 866cbb8 chore: mark v1.64.1 (#43354)
  • 1b29247 cherry-pick(#43250): fix(electron): do not drop windows that have not navigat...
  • 632d976 cherry-pick(#43249): fix(chromium): disable AvoidCorsURLLoaderRestartOnRedirect
  • 824d0c5 cherry-pick(#43217): chore(dotnet): fix async suffix of optional-arg overload...
  • 606ecd8 cherry-pick(#43192): fix(locators): parse locators the way the client API bui...
  • e4f872c cherry-pick(#43188): feat(api): expose asLocatorDescription via LocalUtils fo...
  • f6a439e cherry-pick(#43189): docs(webmcp): expose WebMCP to all languages
  • e2335c3 cherry-pick(#43174): fix(mcp): do not close the browser twice when the client...
  • d2a436e cherry-pick(#43163): Revert "fix(blob): do not remove existing reports from o...
  • Additional commits viewable in compare view

Updates @testing-library/user-event from 14.6.7 to 14.6.8

Release notes

Sourced from @​testing-library/user-event's releases.

v14.6.8

14.6.8 (2026-10-13)

Bug Fixes

  • treat programmatic null input values as empty string (#1329) (1951eb7)
Commits

Updates @vitest/coverage-v8 from 5.0.0 to 5.0.5

Release notes

Sourced from @​vitest/coverage-v8's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Updates vitest from 5.0.0 to 5.0.5

Release notes

Sourced from vitest's releases.

v5.0.5

   🐞 Bug Fixes

    View changes on GitHub

v5.0.4

   🚀 Features

   🐞 Bug Fixes

... (truncated)

Commits

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

v1.11.0

Build: the branch prerelease publishes the APK once every gate passes.

Highlights

Phase A — it is a menu, not a bucket

  • Six of thirteen languages showed users a transliteration of English
    jargon.     बकेट, バケット, บัคเก็ต carry no meaning in Hindi, Japanese
    or Thai; French called it a shopping basket (Paniers) and Italian left it
    in English. Meanwhile the tours, the marketing site and all six guides
    already said "menu", so the product spoke two languages about its own
    central object. Every locale now uses its own natural word.
  • Where that word is grammatically gendered the replacement keeps the gender
    (Spanish carta, German Speisekarte), so surrounding articles stay
    correct. That is why this shipped as an explicit table rather than a
    find-and-replace.
  • Permission levels now say what a person can do: "Can order", "Can
    change the menu", "Can only look", "Remove access" — replacing
    Contributor, Editor, Viewer and Revoke. Role nouns are worse than jargon,
    because "Contributor" looks like a word the reader should already know, so
    they do not ask.

Phase B — five destinations, and text you can read

  • The bottom bar had grown to eight items and scrolled sideways. A
    navigation bar that scrolls hides options from exactly the person least
    likely to find them by swiping. It is now five, all visible at once on a
    390px phone: Home, Menus, Rounds, Members, Settings.
  • Rounds gained an entry point it never had, despite being the feature the
    product is built around. Orders lost its own tab: the home screen already
    lists recent orders, and an order is reached through the menu or round it
    belongs to. Home, About and Contact moved into Settings.
  • Text now has a floor: body 16px, nothing below 13px, targets at least
    48px. Measured in a browser at 390px — navigation labels went from
    10.56px to 13.12px, smallest target 47px to 51px, and there are now
    zero elements under 13px on the signed-in page.

Phase C — one screen for sharing, not four

  • A menu had seven pages of its own; three of them were about sharing.
    Members and Activity are now collapsible sections of the Share page, closed
    by default so the page still opens on the thing most people came for.
    Reading a person's permissions no longer means leaving the screen that
    grants them.
  • Every old address still resolves. /share/members and /share/activity
    redirect into the section that replaced them, using a fragment so the page
    scrolls to the right place. People bookmark pages and paste them to each
    other, and a link that dies teaches them not to trust the next one.
  • The two superseded containers, their two tour hooks and two route builders
    were deleted rather than left behind; the dead-code gate found them.

Phase D — help where it helps, silence everywhere else

  • Twenty-two screens had a tour, some eight steps long. For a first-time
    visitor that is an obstacle course between them and the button they came to
    press. Five screens keep a tour and each is three steps: Home, Menus, the
    menu editor, sharing, and a round's details. Replay stays in Settings.
  • The rename had missed the modules. Translations live in seven
    directories, not one, so group-orders still said "Freeze bucket" and social
    still said "Invite friend to bucket" after a release that was supposed to
    have removed the word. Both are rewritten in all thirteen languages, and
    "freeze" is now "stop taking orders" - it says what happens.
  • 3,198 dead strings deleted. Removing seventeen tours orphaned 246 keys
    in each of thirteen locales; they were unreferenced anywhere in source.
    Locale files went from 579 entries to 333.

Phase E — checked, not assumed

  • Wrote a browser-based accessibility audit (tests/e2e/accessibility.spec.ts)
    that walks Home, Menus, Rounds and Settings in both themes on every
    configured browser, checking real WCAG contrast math (relative luminance,
    4.5:1 body text / 3:1 large text), 44px touch targets, unlabelled form
    fields and images without alt, rather than relying on eyeballing a
    screenshot.
  • The light-theme brand colour failed its own contrast requirement.
    --primary: #ea580c measured 3.56:1 with white ink - below the 4.5:1 body
    text needs - on the default button, the active bottom-nav pill, and the
    logo. Every darker orange on the same hue was checked with a WCAG script
    and #c2450a chosen: 5.06:1 solid, 4.74:1 at the far stop of the button's
    gradient, both with real margin, not a bare pass. Dark theme already paired
    a dark ink with a light primary and needed no change.
  • The bottom nav's translucent, blurred background made its own inactive
    labels' contrast unverifiable     - color-mix(... 92%, transparent) behind a
    blur(14px) filter means the true rendered colour depends on whatever the
    page happens to be scrolled to underneath it. It is opaque now
    (var(--surface)), giving every label a fixed, checkable pairing (measured
    9.25:1 dark, 9.3:1 light).
  • Saving any setting reloaded the whole page. saveProfile always passed
    the current locale alongside whatever actually changed, and the session
    controller treated any locale value as "the locale changed" and hard-
    navigated to it - so changing only the theme or full name flashed a full
    page reload every time. It now compares against the locale actually on the
    profile before navigating; a reload only happens when the language itself
    changes.
  • The share link is now the first thing offered, not the join code. On a
    menu's Share page, the invite-link panel renders before the join-code
    panel, which moved into a collapsed "Other ways to invite" section (new
    otherWaysToInvite / otherWaysToInviteHint keys, all thirteen locales) -
    a link a person can tap beats a code they have to retype.
  • Bare links now meet the 44px minimum too: the brand mark (was 36x36)
    and every plain link in the topbar, page headings and section headings.
    Widening those grew some headings by a few px each, which on the
    narrowest, shortest screens this app still supports pushed the last
    section on a long page in behind the fixed bottom nav; the page's bottom
    clearance was widened to match.

Phase F — what the code is actually for, in one place

  • Twelve of sixteen modules had a README; every package, every platform
    adapter directory, and every shared directory had none.     The gap wasn't
    the business modules people read first - it was the thirty other
    directories a new engineer has to open cold. All sixteen modules, all
    thirteen owned package facades, all six platform adapter directories, and
    all four shared directories now have one, in the same
    Responsibility / Public exports / Structure / Dependencies / Testing shape
    the existing module READMEs already used - adopted, not invented.
  • Added docs/product/business-overview.md, the layer between the root
    README's elevator pitch and each module's implementation detail: domain
    object lifecycle (bucket order states, order-session trust boundary),
    bucket roles in the words shown to a person, the pricing-policy fields and
    allocation strategies, the three billing plans and where entitlement
    authority actually lives, and a one-line-per-module map. Linked from
    AGENTS.md and the root README rather than left to be found.
  • Every fact in these 28 documents was read from the source that same pass,
    not inferred from a directory name - three parallel research passes
    covering packages, platform + shared, and the four undocumented modules
    plus src/app/, each instructed to report only what it actually read.

Phase G — a first menu that's actually guided, and the numbers to prove the rest

  • A brand-new account's dashboard called them a returning user. The
    eyebrow always read "Welcome back" and the intro line always described
    "what is open right now and what recently closed" - copy written for
    someone with an order history, shown to someone thirty seconds into their
    first session with neither. It now reads "Welcome!" and points straight
    at creating a first menu, for exactly as long as bucketCount is zero -
    the moment they create one, the dashboard reverts to the normal returning
    -user greeting on the next visit. Verified live end to end, then locked
    in by a new spec.
  • Wrote docs/ux/v1.11.0-tap-count-walkthrough.md, the manual
    walkthrough this release's own plan called for and hadn't produced yet.
    Every "before" figure in it is read from 8170e63 (the v1.10.1 commit
    this release branched from), not from memory or the earlier phases'
    release notes - the old bottom nav's fixed 68px item width and 366px
    available width at 390px, the three separate share routes, the join-code
    panel rendered before the share-link panel. Every "after" figure was
    walked through live in a browser against the current build. It states one
    real trade-off plainly rather than only counting wins: reaching About/
    Contact went from a single tap (when they happened to be scrolled into
    view, as the 7th/8th of 8 items) to two taps through Settings, a
    deliberate cost on the two least-used destinations that bought the five
    most-used ones a guaranteed, scroll-free single tap each.

Phase H — a className is a promise the CSS has to keep

  • Reported: the Share page's collapsible-section titles and hints
    rendered as one run-on string - "Other ways to inviteA code they type in,
    if a link will not reach them." <strong> and <span class="muted"> are
    both inline by default, and the markup added in Phase E never gave them a
    layout of their own. Fixed for every collapsible section summary in the
    app in one rule, not just the one reported.
  • Audited the rest of the app for the same class of defect by cross-
    referencing every className used in JSX against every selector actually
    defined across every stylesheet - not a visual skim, a mechanical diff of
    what the code asks for against what the code provides. Found eight more,
    ranging from cosmetic to severe:
    • .stack-xs, referenced in 8 components across order-sessions, session-
      invites and settings, never defined anywhere - each rendered its own
      title/hint pairs, and in one case a whole form, as unspaced text.
    • .member-count-pill (a group's member count next to its name) never
      defined - it ran straight into the name with no space and no badge
      styling at all.
    • .measure, expected to give two order-session page intros the same
      readable line length .page-intro already builds in, never defined -
      those paragraphs ran the full width of a desktop screen.
    • className="sr-only" on a fieldset legend and a busy-state
      announcement - the real class in this codebase is .visually-hidden;
      both were rendering visibly instead of being screen-reader only.
    • The most severe finding: BusyButton's className prop replaces
      its own 'button' default rather than merging with it, and the invite
      -link accept button - the one control that actually redeems an invite -
      passed className="primary", which is not a defined class anywhere.
      The single most important button on the /join/:token screen was
      rendering with no color, no padding, and no 44px touch target at all.
    • The invite-link preview card used .card instead of .section-card,
      so it had no border, background, or padding; its subject line (what a
      person is actually being asked to join) had no visual emphasis.

Phase I — the last recommendation: undo, not just a warning

  • Confirming a delete used to be the only chance to stop it. The confirm
    dialog states the consequence plainly ("Delete this menu? Orders already
    placed stay as they are.") but the write itself fired the instant a person
    tapped confirm - a slip of the thumb on the wrong row was as permanent as
    a deliberate choice.
  • Added a real undo, not a longer confirmation. Deleting a menu, a
    friend group, or a shared menu's member now hides it immediately but does
    not actually write the delete for six seconds; the "Deleted. Undo" toast
    that raises during that window cancels the write outright if tapped, so
    undo reverses a delete that never happened rather than reversing one that
    did. Letting the toast run out commits it for real - confirmed both ways,
    live, including reloading the page mid-window to prove the item was never
    actually removed until the window closed.
  • Built as one reusable hook, useUndoableDelete (@/shared/ui), used
    identically by all three flows rather than three separate timers: it
    tracks which ids are pending, and each caller filters (or optimistically
    edits) its own rendered list by that set. The toast system itself gained a
    generic action (label + handler), used here for "Undo" but not specific
    to it, and an actionable toast stays up twice as long (6s vs. 3.6s) since
    it has to be read, understood, and reacted to, not just read.
  • Scoped to the three highest-stakes destructive actions this release's own
    audit named: deleting a menu, deleting a friend group, and removing a
    member from a shared menu. Every other confirm-then-delete action in the
    app (leaving a group, revoking an invite, account deletion) still deletes
    immediately on confirmation, per the existing pattern.

Full notes: release-notes/v1.11.0.md

@dependabot
chore(deps-dev): bump the testing group across 1 directory with 4 upd…
fa45857 
…ates

Bumps the testing group with 4 updates in the / directory: [@playwright/test](https://github.com/microsoft/playwright), [@testing-library/user-event](https://github.com/testing-library/user-event), [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `@playwright/test` from 1.63.0 to 1.64.1
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.63.0...v1.64.1)

Updates `@testing-library/user-event` from 14.6.7 to 14.6.8
- [Release notes](https://github.com/testing-library/user-event/releases)
- [Changelog](https://github.com/testing-library/user-event/blob/main/CHANGELOG.md)
- [Commits](testing-library/user-event@v14.6.7...v14.6.8)

Updates `@vitest/coverage-v8` from 5.0.0 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/coverage-v8)

Updates `vitest` from 5.0.0 to 5.0.5
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Changelog](https://github.com/vitest-dev/vitest/blob/main/docs/releases.md)
- [Commits](https://github.com/vitest-dev/vitest/commits/v5.0.5/packages/vitest)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.64.1
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: testing
- dependency-name: "@testing-library/user-event"
  dependency-version: 14.6.8
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: testing
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: testing
- dependency-name: vitest
  dependency-version: 5.0.5
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: testing
...

Signed-off-by: dependabot[bot] <support@github.com>
@vercel

vercel Bot commented Oct 18, 2026 •
edited
Loading

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
food-order-v1 Ready Ready Preview Oct 18, 2026 8:04pm UTC

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Oct 18, 2026

This branch was successfully deployed

1 active deployment
Preview — fa458570 Deployed Oct 18, 2026 by vercel[bot]
View deployment
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants