[dependabot]

Bumps the dev group with 10 updates in the / directory:

Package	From	To
@capacitor/android	8.5.3	8.6.0
@capacitor/cli	8.5.3	8.6.0
@capacitor/core	8.5.3	8.6.0
@playwright/test	1.64.1	1.65.0
@tauri-apps/plugin-notification	2.7.0	2.8.0
@types/node	26.6.5	26.6.6
@vitejs/plugin-react	6.1.2	6.2.1
marked	18.1.1	18.1.3
vite	8.3.5	8.3.6
vitest	5.0.5	5.1.0

Updates @capacitor/android from 8.5.3 to 8.6.0

Release notes

Sourced from @​capacitor/android's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

Changelog

Sourced from @​capacitor/android's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @capacitor/cli from 8.5.3 to 8.6.0

Release notes

Sourced from @​capacitor/cli's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

Changelog

Sourced from @​capacitor/cli's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @capacitor/core from 8.5.3 to 8.6.0

Release notes

Sourced from @​capacitor/core's releases.

8.6.0

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

Changelog

Sourced from @​capacitor/core's changelog.

8.6.0 (2026-10-28)

Bug Fixes

• android: keep callbacks on non-public base classes from R8 (02e43f8)
• android: keep plugin annotation types from R8 full mode (#8646) (9dc5aeb)
• cli: bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674) (463225f)
• cli: redact sensitive values from telemetry payloads (#8665) (d19f1ea)
• cli: report npm 12 blocked install scripts in doctor and migrate (#8655) (841017a)

Features

• android: recognize @​capacitor-community/ssl-pinning for cert pinning (#8669) (19d2a40)
• cli: recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666) (50a3c51)

Reverts

• Revert "chore(ios): add App/CapApp-SPM/Package.resolved to .gitignore (#8649)" (175c933), closes #8649

Commits

• ef3ce6e Release 8.6.0
• 4b40f4b chore: add Backstage catalog-info.yaml
• 463225f fix(cli): bump xcode to ^4.0.0 to drop vulnerable uuid@7 (#8674)
• d19f1ea fix(cli): redact sensitive values from telemetry payloads (#8665)
• 02e43f8 fix(android): keep callbacks on non-public base classes from R8
• 19d2a40 feat(android): recognize @​capacitor-community/ssl-pinning for cert pinning (#...
• 50a3c51 feat(cli): recognize @​capacitor-community/ssl-pinning for auto cert copy (#8666)
• 841017a fix(cli): report npm 12 blocked install scripts in doctor and migrate (#8655)
• acaa9e6 docs: minor correction (#8660)
• 9dc5aeb fix(android): keep plugin annotation types from R8 full mode (#8646)
• Additional commits viewable in compare view

Updates @playwright/test from 1.64.1 to 1.65.0

Release notes

Sourced from @​playwright/test's releases.

v1.65.0

🥟 Run tests with Bun

The test runner now runs under Bun. Bun transpiles your TypeScript test files itself, so Playwright does not use Babel or its compilation cache. Pass the --bun flag, because without it bunx playwright test runs on Node.js:

bunx --bun playwright test

Our CI runs the test runner tests under Bun 1.4.3 on Linux. Some features work differently under Bun:

• There is no watch mode. UI mode does not run tests again when files change, and --only-changed does not follow imports.
• Bun loads modules itself, so --tsconfig and the JSX options in tsconfig.json have no effect, and custom ESM loaders are not supported.
• Stack traces do not include async frames, and API names do not include the class name: click instead of locator.click. This changes some step locations, step titles and error messages.
• Console output of a test does not get into the trace and UI mode.

🚨 Reports with only failures

New failures reporter prints failures and successful retries as they occur, followed by a summary, without progress output.

New onlyFailures option of the HTML, JSON and JUnit reporters keeps only tests with unexpected outcomes, flaky tests and interrupted tests:

// playwright.config.ts
import { defineConfig } from '@playwright/test';
export default defineConfig({
reporter: [
['failures'],
['html', { onlyFailures: true }],
],
});

🎯 Test runner

• New built-in -exclusive- test lock runs a test only when no other tests are running. All other tests continue to run in parallel with each other:

  test('restart the server', { lock: '-exclusive-' }, async () => {
    // No other test runs while this one is running.
  });

• test.skip(), test.fixme(), test.fail() and test.slow() now accept only a description. It is recorded in the test annotation:

  test('upload a file', async ({ page }) => {
    test.skip('Not implemented yet');
  });

... (truncated)

Commits

• a1f35e1 chore: mark v1.65.0 (#43925)
• a99c1ab cherry-pick(#43918): Revert "fix(docker): use latest stable Chrome for Testin...
• 6f9a7f5 cherry-pick(#43914): docs(release-notes): update Chromium version for 1.65
• daf93bb cherry-pick(#43912): feat(chromium): roll to r1254
• 6545e89 cherry-pick(#43902): chore(deps): bump runtime deps
• 0347448 fix(test runner): track shared ESM dependencies for only-changed (#43837)
• 86e6924 fix(clock): cancel real-time timer when replay ends paused (#43873)
• d745ae0 fix(route): wait for all active handlers before disabling interception (#43889)
• 6e3f5ff docs: release notes for v1.65 (#43874)
• aa33d27 fix(chromium): honor Linux config directories for channel connections (#43884)
• Additional commits viewable in compare view

Updates @tauri-apps/plugin-notification from 2.7.0 to 2.8.0

Release notes

Sourced from @​tauri-apps/plugin-notification's releases.

notification-js v2.8.0

[2.8.0]

• 52fa7754 (#3738 by @​renovate) Updated dependency rand to 0.10

feat

• f36ba7ba (#3282 by @​Et3rnel) Added chronometer support for Android notifications with when, usesChronometer, and chronometerCountDown options. This allows displaying an automatically updating elapsed time counter directly in the notification, useful for time-tracking apps, ongoing calls, or timers.

npm warn publish npm auto-corrected some errors in your package.json when publishing.  Please run "npm pkg fix" to address these errors.
npm warn publish errors corrected:
npm warn publish "repository" was changed from a string to an object
npm warn publish "repository.url" was normalized to "git+https://github.com/tauri-apps/plugins-workspace.git"
npm notice
npm notice 📦  @tauri-apps/plugin-notification@2.8.0
npm notice Tarball Contents
npm notice 888B LICENSE.spdx
npm notice 4.2kB README.md
npm notice 16.6kB dist-js/index.cjs
npm notice 27.0kB dist-js/index.d.ts
npm notice 16.2kB dist-js/index.js
npm notice 11B dist-js/init.d.ts
npm notice 663B package.json
npm notice Tarball Details
npm notice name: @tauri-apps/plugin-notification
npm notice version: 2.8.0
npm notice filename: tauri-apps-plugin-notification-2.8.0.tgz
npm notice package size: 11.4 kB
npm notice unpacked size: 65.7 kB
npm notice shasum: b37835641011d62d25bd923310d9e6217a1e5685
npm notice integrity: sha512-BB9Kk2emiNHyM[...]f0O8rtdW2F2dw==
npm notice total files: 7
npm notice
npm notice npm tokens that bypass 2FA are being restricted for account changes and direct publishing. Learn how to prepare: https://gh.io/npm-gat-bypass2fa-deprecation
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=3529333733
npm notice Your package is being processed and may take a few minutes to become available.
+ @tauri-apps/plugin-notification@2.8.0

notification v2.8.0

[2.8.0]

... (truncated)

Commits

• 6e2e7e4 publish new versions (#3070)
• 9a2c98f temp: remove updater changefiles
• 4a2ecb6 chore(deps): update rkyv, closes #3196
• 31415ef docs(shell): update example to include Encoding usage in Command::spawn (#3...
• 04b33ea chore(deps): update dependency typescript-eslint to v8.50.1 (#3181)
• 54e21f1 chore(deps): update dependency rollup to v4.54.0 (#3179)
• d528c88 chore(deps): update dependency rollup to v4.53.5 (#3172)
• 69146fa chore(deps): update dependency rollup to v4.53.4 (#3167)
• 9f68f2d chore(deps): update dependency typescript-eslint to v8.50.0 (#3170)
• 3d0d2e0 fix(opener): ignore inAppBrowser on desktop (#3163)
• Additional commits viewable in compare view

Updates @types/node from 26.6.5 to 26.6.6

Commits

• See full diff in compare view

Updates @vitejs/plugin-react from 6.1.2 to 6.2.1

Release notes

Sourced from @​vitejs/plugin-react's releases.

plugin-react@6.2.1

Fix refreshInclude and refreshExclude options not working (#1543)

Fix mistake from #1516

plugin-react@6.2.0

Add refreshInclude and refreshExclude options (#1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

Changelog

Sourced from @​vitejs/plugin-react's changelog.

6.2.1 (2026-11-02)

Fix refreshInclude and refreshExclude options not working (#1543)

Fix mistake from #1516

6.2.0 (2026-11-02)

Add refreshInclude and refreshExclude options (#1516)

Add refreshInclude and refreshExclude options to skip fast refresh for certain files that won't run in the browser.

Expand oxc-transform-react peer dependency range (#1540)

The peer dependency version range for oxc-transform-react was expanded from ^0.152.0 to >=0.152.0 <0.157.0.

Expand @rolldown/plugin-babel peer dependency range (#1541)

The peer dependency version range for @rolldown/plugin-babel was expanded from ^0.1.7 || ^0.2.0 to ^0.1.7 || ^0.2.0 || ^0.3.0.

Commits

• 29efd1c release: plugin-react@6.2.1 (#1544)
• 22079fa fix(plugin-react): fix new refreshInclude option (#1543)
• d0f7234 release: plugin-react@6.2.0 (#1542)
• 186d1e8 feat(plugin-react): expand @rolldown/plugin-babel peer dep range (#1541)
• a554a33 feat(plugin-react): expand oxc-transform-react peer dep range (#1540)
• ef758ba fix(deps): update all non-major dependencies (#1531)
• 304a92a feat(plugin-react): add refreshInclude and refreshExclude options (#1516)
• b3e9835 fix(deps): update all non-major dependencies (#1517)
• 65a1dd5 fix(deps): update react 19.3.1 (#1509)
• 443be64 chore(deps): update dependency typescript to v7 (#1422)
• Additional commits viewable in compare view

Updates marked from 18.1.1 to 18.1.3

Release notes

Sourced from marked's releases.

v18.1.3

18.1.3 (2026-11-02)

Bug Fixes

• allow trailing tabs after a setext heading underline (#4152) (1f1b480)
• avoid quadratic scan for unmatched emphasis delimiters (#4103) (eab1e48), closes #4099
• await promise arrays from walkTokens extensions (#4153) (c38704c)
• cli: honor defaults and config when outputting tokens (#4146) (9470e8f)
• collapse internal whitespace when normalizing link labels (#4157) (02c73e8)
• do not allow a blank line inside a link reference definition label (#4165) (f3d21af)
• don't treat an escaped ) or quote as an inline link or title closer (#4151) (9cb84e0)
• end a list item before a lazy line after an html block (#4159) (7ba42f4)
• end blockquote before a lazy line after a table (#4161) (e7dcf52)
• isolate extension names from Object.prototype (#4177) (5cb03bd)
• keep a block quote open after a lazy line in a nested block quote (#4175) (1d7272f)
• only close a code fence with the opening fence character (#4164) (1d4d8fe)
• preserve zero-valued custom renderer results (#4162) (e43ceef)
• recognize task list items when a tab follows the checkbox (#4163) (64a299d)
• start a GFM www autolink only at a word boundary (#4166) (84beefb)

Performance Improvements

• fix backtracking in padantic html (#4173) (2d4a23c)

v18.1.2

18.1.2 (2026-10-26)

Bug Fixes

• allow a tab or end of input after a type 6 html block tag name (#4128) (e09c40d)
• apply emphasis flanking and rules 9-10 to the whole delimiter run (#4145) (5d8e234)
• cli: await config functions before parsing (#4138) (3a11ad1)
• cli: create no-clobber output files atomically (#4135) (e7c4f64)
• do not continue a block quote paragraph from a whitespace-only line (#4134) (42f34a8)
• expand a tab after the block quote marker to the next tab stop (#4110) (2d3899b)
• honor per-call async options when composing hooks (#4139) (379be9d)
• keep a line starting with # but no space in the list item (#4127) (6b63189)
• keep duplicate link definitions in the tokens (#4132) (2784acc)
• keep lazy lines after a list in a nested blockquote (#4137) (38c7e55)
• keep lazy setext underlines in list items as text (#4126) (398234c)
• render nested image alt formatting as plain text (#4131) (15f59bb)
• stop an unclosed inline raw tag from unescaping later blocks (#4130) (4562b6f)

Performance Improvements

... (truncated)

Commits

• ba50aa9 chore(release): 18.1.3 [skip ci]
• ec34be8 chore(deps-dev): bump eslint from 10.13.0 to 10.14.0 (#4182)
• e4c7453 chore(deps-dev): bump recheck from 4.6.1 to 4.6.2 (#4181)
• 1d7272f fix: keep a block quote open after a lazy line in a nested block quote (#4175)
• 2d4a23c perf: fix backtracking in padantic html (#4173)
• 5cb03bd fix: isolate extension names from Object.prototype (#4177)
• f3d21af fix: do not allow a blank line inside a link reference definition label (#4165)
• 1d4d8fe fix: only close a code fence with the opening fence character (#4164)
• 64a299d fix: recognize task list items when a tab follows the checkbox (#4163)
• e43ceef fix: preserve zero-valued custom renderer results (#4162)
• Additional commits viewable in compare view

Updates vite from 8.3.5 to 8.3.6

Release notes

Sourced from vite's releases.

v8.3.6

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (4f340fd)
• html: remove adjacent module tags on the first line (#23823) (eab1dc2)
• ignore pnpm's .modules.yaml as a Vite Task input (#23634) (95c2daf)
• optimizer: detect cache dir precisely (#23912) (cc9bc21)
• optimizer: resolve subpath imports (#) with Vite's resolver (#23959) (0fdd81e)
• respect build.sourcemap from environment (#23879) (82e7aa0)
• server: escape HTML attributes (#23995) (a270391)
• server: preserve $ patterns in static alias replacements (#23703) (1b6ed05)
• ssr: convert external require against built-in modules to import for ssr.target=webworker (#23759) (a711f1c)
• use top-level input for SSR build when build.ssr: true (#23898) (90bc034)
• wasm: reject .wasm outside server.fs (#23914) (64e2467)
• watch files that have a query or hash referenced with new URL(..., import.meta.url) (#23780) (e954a9c)
• worker: keep chunks conflicted with unused workers that are still used by a live worker (#23956) (7139ef3)

Performance Improvements

• build: remove preload link listeners on settle (fix #23920) (#23922) (8109efd)
• css: index rendered modules once per output for cssScopeTo (#23889) (1b905e5)

Miscellaneous Chores

• align charset case (#23863) (a976df3)

Build System

• generate sourcemaps in import-meta-current-dirname plugin (#23904) (20d355a)

Changelog

Sourced from vite's changelog.

8.3.6 (2026-11-05)

Bug Fixes

• await overlapping plugin container close calls (#23935) (175bbeb)
• build: resolve dynamic imports with queries appended when collecting CSS dependencies (#23909) (df36558)
• build: use stable module ids in chunk import map hash signatures (fix #23975) (#23976) (8069835)
• bundled-dev: allow named imports from Node built-ins (#23858) (4260c75)
• bundled-dev: reload when hmr cannot run an entry again (#23849) (a236886)
• deps: update @rollup/plugin-alias to v6.0.1 (#23862) (67c965b)
• deps: update all non-major dependencies (#23896) (46b91c5)
• deps: update all non-major dependencies (#23966) (b3cb057)
• deps: update rolldown-related dependencies (#23868) (a63eb87)
• deps: update rolldown-related dependencies (#23967) (0105733)
• dev: escape ANSI escape sequence for server.forwardConsole (#23933) (