chore(deps): update all dependencies by renovate[bot] · Pull Request #15 · aperturerobotics/flex-layout

renovate · 2026-05-09T01:44:16Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Type	Update
@testing-library/jest-dom	`^6.9.1` → `^7.0.0`	devDependencies	major
@types/node (source)	`^25.6.0` → `^26.0.0`	devDependencies	major
@vitest/browser (source)	`^4.1.4` → `^5.0.0`	devDependencies	major
@vitest/browser-playwright (source)	`^4.1.4` → `^5.0.0`	devDependencies	major
actions/checkout	`v6.0.2` → `v7.0.1`	action	major
actions/checkout	`v6` → `v7`	action	major
actions/dependency-review-action	`v4` → `v5.0.0`	action	major
actions/setup-node	`v6` → `v7`	action	major
jsdom	`^29.0.0` → `^30.0.0`	devDependencies	major
typescript (source)	`^6.0.0` → `^7.0.0`	devDependencies	major
vitest (source)	`^4.1.4` → `^5.0.0`	devDependencies	major

Release Notes

testing-library/jest-dom (@testing-library/jest-dom)

vitest-dev/vitest (@vitest/browser)

`v5.0.1`

Compare Source

🚀 Features

ui:
- Move trace attempts selector to viewer header - by @hi-ogawa, Hiroshi Ogawa and Codex in #11189 (5dc4b)
- Add focused trace view layout mode - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #11190 (376dc)

🐞 Bug Fixes

Exit 1 when vitest list fails collection - by @hamed-bavar in #11145 and #11146 (6108b)
Keep parse error details in static collection - by @hamed-bavar in #11150 and #11151 (7c818)
Avoid recursive prototype in automocking - by @sheremet-va in #11195 (99fc5)
Prevent false Vitest import resolution - by @sheremet-va in #11196 (b426c)
Keep metadata file when clearing the cache - by @sheremet-va in #11199 (73614)
Correct typos in error message and comments - by @shinji00222 and Shinji in #11187 (115c3)
Resolve ResolvedConfig exactOptionalPropertyTypes errors - by @LukeAbby in #11175 (498fb)
Share the server on self-referencing extends - by @sheremet-va in #11034 (23dda)
Warn when deprecated deps.optimizer.web is used - by @im10furry in #11214 (2ce29)
browser:
- Avoid double quotes in config.define - by @sheremet-va in #11198 (972e2)
doctor:
- Measure vm pools for custom environments - by @sheremet-va in #11212 (91ab1)
expect:
- Correct return value in toMatchAriaSnapshot - by @sheremet-va in #11208 (c119b)
fakeTimers:
- Force queueMicrotask and nextTick in toNotFake - by @kingmakeruix, kingmakeruix, Hiroshi Ogawa, Codex and @hi-ogawa in #11261 (a47d7)
snapshot:
- Report obsolete keys next to skipped tests - by @hamed-bavar, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #11157 and #11158 (17e2b)
types:
- Make public declarations self-contained - by @ZoeySigel in #11141 (45546)
ui:
- Fix collapse/expand suite with file name search - by @hi-ogawa, Hiroshi Ogawa and Codex in #11260 (0a712)
- Fix explorer file summary count - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and Codex in #11125 (05982)
utils:
- Fix deepMerge to handle prototype - by @hi-ogawa, Hiroshi Ogawa and Codex in #11215 (4944c)

View changes on GitHub

`v5.0.0`

Compare Source

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

🚨 Breaking Changes

Replace loupe.inspect with pretty-format - by @hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in #9609 (3f802)
Remove quotes from string values in test.for/each title $ variable (take 2) - by @hi-ogawa in #10170 (04d37)
Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/ - by @MdSadiqMd in #10186 (1ba73)
Remove sequential test/suite options in favor of concurrent - by @hi-ogawa and OpenAI Codex in #10198 (9229f)
Represent locator as an object instead of a string - by @sheremet-va in #10212 (80f07)
Inline expect package - by @sheremet-va in #10221 (ad162)
Remove deprecated entry points - by @sheremet-va in #10222 (994c6)
Require Node.js 22 and Vite 6.4 - by @sheremet-va in #10178 (38762)
Fail expect.poll when function didn't resolve in time - by @hi-ogawa and OpenAI Codex in #10233 (4df04)
Throw an error if hoistable methods are outside the top level scope - by @sheremet-va in #10460 (d0b4f)
toHaveTextContent is strict, add toMatchTextContent as alternative - by @sheremet-va in #10473 (18f30)
Don't lookup config file from ancestor directories - by @hi-ogawa, OpenAI Codex and Hiroshi Ogawa in #10428 (945d9)
Inline @vitest/runner package, do not publish it anymore - by @sheremet-va in #10511 (6d6e4)
Allow mutating happy-dom/jsdom window object - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #10373 (206e8)
Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based - by @sheremet-va in #10516 (bdd98)
Add screenshotDirectory config to browser.expect.toMatchScreenshot - by @macarie in #10592 (a60de)
Update @sinonjs/fake-timers and support mocking Temporal - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #10654 (f8b15)
Remove webdriverio package - by @sheremet-va in #10675 (5fed6)
Clear mocks by default before each test - by @sheremet-va in #10613 (0f646)
Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start - by @sheremet-va in #10293 (334ed)
Separate config resolution from the server creation - by @sheremet-va in #10554 (1c0ec)
Inline projects extend the root config by default - by @sheremet-va in #10750 (fec00)
Enable mocking Temporal without fake timers - by @fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #10757 (ac2d4)
Support nested projects - by @sheremet-va in #10846 (ec367)
Use > as separator in -t, calculate only once - by @sheremet-va in #10686 (a0b20)
Fail the test when an asynchronous assertion is not awaited - by @sheremet-va in #10868 (86d4a)
Share the Vite server between inline projects - by @sheremet-va in #10848 (d87c9)
Parse files statically in vitest list by default - by @sheremet-va in #11088 (51e94)
benchmark:
- Rewrite the public API - by @sheremet-va in #10113 (19f6e)
browser:
- Iframe scale - by @macarie in #9745 (b6398)
- Enable locators.exact by default - by @sheremet-va in #10430 (e2032)
- Require sessionId for orchestrator html request - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #10522 (79b7d)
- Save failure screenshots in attachmentsDir - by @macarie in #10917 (3b5bb)
coverage:
- include/exclude globs too eager - by @AriPerkkio in #9818 (edacb)
- Allow thresholds.perFile to accept an object - by @vladlenskiy and @AriPerkkio in #10190 (13b78)
expect:
- Fix toThrow("") behavior by reverting #6710 - by @hi-ogawa in #9643 and #6710 (6c3e4)
mocker:
- Deserialize automock as automock - by @nami8824 in #10192 (2f892)
reporters:
- blob reporter and --merge-reports default to .vitest/blob/ - by @AriPerkkio in #10232 (d22b0)
- Write json and junit reporter output files to .vitest by default - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @AriPerkkio in #10621 (58577)
spy:
- Preserve class mock prototype methods on instances - by @sheremet-va in #10910 (6093d)
types:
- Add better promise support in expects and matchers - by @samchungy and @sheremet-va in #8266 (41f55)
ui:
- Harden UI API access - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #10583 (4c26d)
- Change html reporter default output to .vitest - by @hi-ogawa and Hiroshi Ogawa in #10620 (29c36)

🚀 Features

Add createReport and .vitest report directory convention - by @AriPerkkio in #9993 (72a6d)
Expose default reporters through configDefaults.reporters - by @hi-ogawa and Claude Opus 5 (1M context) in #10219 (083f6)
Support merge reports for non-sharded multi-environment runs (take 2) - by @hi-ogawa, Claude Opus 5 (1M context), OpenAI Codex and @AriPerkkio in #10031 (e60b2)
Add logger.formatError - by @hi-ogawa and OpenAI Codex in #10268 (2c5f3)
Support typescript build mode - by @lishaduck in #9870 (106da)
Add toggable injectCjsGlobals option - by @sheremet-va in #10709 (82671)
Promote fsModuleCache to a top-level option - by @sheremet-va in #10734 (78ed7)
Support non-ascii characters in for/each title placeholders - by @k-yle in #10773 (15e0a)
Report the duration breakdown as percentages - by @sheremet-va and @AriPerkkio in #10820 (c67d2)
Promote parseSpecifications out of experimental - by @sheremet-va in #11087 (b628c)
Promote clearCache out of experimental - by @sheremet-va in #11086 (d4fe1)
api:
- Expose logs recorded during the test - by @sheremet-va in #10277 (cba20)
benchmark:
- Add pluggable benchmark provider API - by @GuillaumeLagrange and @sheremet-va in #10799 (86c70)
browser:
- Export aria tree utils - by @hi-ogawa in #10171 (c3423)
- Support dom snapshot trace view - by @hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in #10102 (7eddd)
- Provide project reference in ToMatchScreenshotResolvePath - by @macarie and @sheremet-va in #10138 (16654)
- Show aria tree on locator element error - by @hi-ogawa and OpenAI Codex in #10257 (04f04)
- Support custom kind in page.mark - by @AriPerkkio in #10302 (053e8)
- Live update trace view on watch UI - by @hi-ogawa and OpenAI Codex in #10296 (78c11)
- Add context.mark for custom command tracing - by @AriPerkkio in #10329 (aa514)
- Show trace view steps in editor panel - by @hi-ogawa and OpenAI Codex in #10404 (8c4b6)
- Display nested mark trace in UI - by @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #10437 (86ffc)
cli:
- Add --repeats CLI option - by @todor-a in #10504 (ee48b)
- Support -p shorthand for --project - by @sheremet-va in #10826 (1addd)
coverage:
- V8 to track node:child_process and node:worker_threads contexts - by @AriPerkkio in #9976 (9baa5)
- thresholds.autoUpdate to receive previous threshold as argument - by @wouterkroes in #10495 (04f81)
- Switch to @vitest/istanbuljs packages - by @AriPerkkio in #11053 (5f6a5)
junit-reporter:
- Add jest-junit-compatible naming options - by @neumaennl, neumaennl, Martin Neumann and Copilot in #10189 (27393)
reporter:
- Support html reporter single file output - by @hi-ogawa, OpenAI Codex and Claude Opus 5 (1M context) in #10235 (f757e)
- Add custom GitHub Actions summary title - by @heyJonBray and @macarie in #10891 (4363c)
ui:
- Highlight editor source locations - by @sheremet-va, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #11004 (bce2d)
- Navigate trace steps with keyboard and remove indirect editor focus - by @sheremet-va, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #11005 (6816f)
- Persist trace view selection in URL - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #10981 (3069e)
- Toggle trace target highlight - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #11049 (cd63e)
- Add link to open playwright trace - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #11059 (58f02)
vitest:
- Create vi.when() - by @macarie in #10174 (3900e)
vm:
- Support require(esm) in vm pools - by @sheremet-va in #10829 (01298)

🐞 Bug Fixes

Global sequence.concurrent: true with top-level test(..., { concurrent: false }) + depreacte sequential test API and options - by @hi-ogawa, OpenAI Codex and @sheremet-va in #10194 (9387f)
Test tags options should overwrite inherited suite options + inherit suite options in task API - by @hi-ogawa and OpenAI Codex in #10216 (457db)
Udpate optimize deps config - by @sheremet-va in #10223 (95dc6)
Shell injection safety via github.ref_name in publish workflow - by @lloyd-c137 and lloyd-c137 in #10327 (dd020)
Make attachmentsDir root only config - by @hi-ogawa and OpenAI Codex in #10334 (fab1b)
Apply cjs interop for truthy __esModule - by @hi-ogawa in #10363 (2b135)
Preserve vi.defineHelper callsite for async error stack - by @macayu17 and @hi-ogawa in #10415 (ac697)
Respect disableConsoleIntercept in browser mode - by @Copilot, Hiroshi Ogawa, @hi-ogawa and OpenAI Codex in #10391 (66110)
ForceRerunTriggers uses directory globs against files - by @Patrick-Clausen and Patrick Clausen in #10421 and #10420 (4fee2)
Unify typechecking and ast collection - by @sheremet-va in #10449 (af993)
Don't print typecheck warning more than once - by @sheremet-va in #10461 (15275)
Correct collumn when parsing tests - by @sheremet-va in #10467 (7c2fc)
Fix mixed stdout/stderr log timestamps in onUserConsoleLog - by @Copilot, Hiroshi Ogawa, @hi-ogawa and @sheremet-va in #10308 (62756)
Fix importOriginal with optimizer and query import - by @davidxharris, David Harris, @hi-ogawa, Hiroshi Ogawa and OpenAI Codex in #10469 (6a3bb)
Correct transform time calculation in merged report - by @potatomatoooo and @hi-ogawa in #10570 and #10578 (b7897)
Fix setImmediate await in detect-async-leak - by @hi-ogawa and Hiroshi Ogawa in #10608 (dd62b)
Fix per-project sequence config - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #10659 (40cdc)
Add handshake timeout to iframe communication - by @sheremet-va in #10656 (3545f)
Don't print column in test names when includeTaskLocation is enabled - by @sheremet-va in #10681 (bd9cc)
Disable server HMR before plugins read it in their config hook - by @sheremet-va in #10731 (e060b)
Close the pool before the Vite servers - by @sheremet-va in #10725 (96fa6)
Remove listeners in the typecheck worker's off - by @sheremet-va in #10741 (d758b)
Keep per-file isolation in vm pools when maxWorkers is 1 - by @sheremet-va in #10743 (83ab9)
Node.js 20 deprecation warning for ci.yml - by @hirehamir in #10759 (2127f)
Prevent node builtins double prefix - by @malobre in #10630 and #10767 (22d35)
Set non-zero exit code when teardown throws during close - by @zakcutner and @AriPerkkio in #10794 (22116)
Don't race the typechecker spawn grace period on windows - by @xevrion in #10814 (b19e5)
Coalesce concurrent watch-mode restarts, deflake the pool stderr fixture - by @sheremet-va in #10822 (a31f8)
Prevent vitest --typecheck from reporting a false success when the tsc process crashes - by @hitenkalda and Hiten Kalda in #10705 (a1b05)
Collect in-source tests when the module is cached - by @koutaro-masaki in #10577 and #10589 (a7bf2)
Swap replace() arguments so timeout error stack shows the real message - by @lazerg in #10875 (aba0f)
Stale mock metadata breaks automocking with isolate:false - by @kade-robertson in #10145 and #10541 (8e210)
Don't lose worker output on teardown, deflake timing-sensitive tests - by @sheremet-va in #10842 (1216b)
Revive global concurrency limit for test lifecycle - by @hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @sheremet-va in #10928 (cf917)
Own the post-restart rerun, keep process.exit disabled in workers - by @sheremet-va in #10963 (5e69a)
Preserve correct root during resolve config - by @AriPerkkio and @sheremet-va in #10909 (210ba)
Combine multiple --project filters correctly - by @sheremet-va in #10988 (66c1c)
Fix recordArtifact location with vi.defineHelper - by @hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in #11047 (c2186)
Invalidate resolved setup files - by @sheremet-va in #11073 and #11081 (488c0)
Accept awaited value in vi.when thenResolve - by @sheremet-va in #11084 (c10a1)
Ignore computed member calls in static collection - by @sheremet-va in #11085 (130f7)
Don't duplicte oxc.target if user provides a custom array - by @sheremet-va in #11095 (848d7)
Propagate --maxWorkers to projects - by @Gaurav1112 in #11102 (2122f)
Apply queued mocks from doMock() in queue order - by @juliandescottes and Claude Opus 5 (1M context) in #10706 and #11127 (f08ce)
Add a warning if inline project has duplicate plugins due to unexpected extends: true - by @sheremet-va in #11120 (584cf)
Treat test.describe as a suite during static collection - by @sheremet-va in #11128 (d46a7)
browser:
- Fix trace highlight of shadow dom on webdriverio - by @hi-ogawa in #10227 (b01af)
- Simplify orchestrator otel carrier - by @hi-ogawa in #10283 (3514f)
- Remove orphaned Playwright route when same module is mocked via multiple ids - by @Zelys-DFKH in #9957 and #10267 (41db6)
- Skip wrapDynamicImport transform on ssr environment - by @hi-ogawa in #10355 (d3c96)
- Fix stale source map on watch mode - by @hi-ogawa in #10389 (6d772)
- Escape inline orchestrator scripts - by @hi-ogawa and OpenAI Codex in #10412 (c22cf)
- Disable client cdp API when allowWrite/allowExec: false - by @hi-ogawa and OpenAI Codex in #10444 [(63e3b)

❗ Important

✂ PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

socket-security · 2026-06-19T09:57:43Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
@vitest/browser@4.1.4 ⏵ 5.0.1		⁺⁷⁵
vitest@4.1.4 ⏵ 5.0.1	⁺¹	⁺²	⁺¹	^-1
@types/node@25.6.0 ⏵ 26.6.1			⁺¹	⁺¹
@vitest/browser-playwright@4.1.4 ⏵ 5.0.1				⁺¹
typescript@6.0.2 ⏵ 7.0.2			^-1		⁺¹⁰
jsdom@29.0.2 ⏵ 30.0.1			⁺¹
@testing-library/jest-dom@6.9.1 ⏵ 7.0.1				⁺³

View full report

socket-security · 2026-07-27T10:18:04Z

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Action	Severity	Alert (click "▶" to expand/collapse)
Warn		Obfuscated code: npm `jsdom` is 90.0% likely obfuscated Confidence: 0.90 Location: Package overview From: package.json → `npm/[email protected]` ℹ Read more on: This package \| This alert \| What is obfuscated code? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at `[email protected]`. Suggestion: Packages should not obfuscate their code. Consider not using packages with obfuscated code. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment `@SocketSecurity ignore npm/[email protected]`. You can also ignore all packages with `@SocketSecurity ignore-all`. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.

View full report

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot changed the title ~~chore(deps): update actions/dependency-review-action action to v5~~ chore(deps): update all dependencies Jun 2, 2026

renovate Bot force-pushed the renovate/all branch from 9c9b386 to 58696da Compare June 2, 2026 15:46

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 845fd19 to de07a4a Compare June 19, 2026 09:57

renovate Bot force-pushed the renovate/all branch from de07a4a to 2f0b132 Compare June 24, 2026 21:42

renovate Bot force-pushed the renovate/all branch 3 times, most recently from 2463482 to 286f0b4 Compare July 8, 2026 20:30

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 9508000 to 84c129f Compare July 20, 2026 22:44

renovate Bot force-pushed the renovate/all branch from 84c129f to 1549994 Compare July 27, 2026 10:17

renovate Bot force-pushed the renovate/all branch 2 times, most recently from fd51c88 to 3834b97 Compare July 29, 2026 06:08

renovate Bot force-pushed the renovate/all branch 2 times, most recently from 408e95f to 2823125 Compare August 10, 2026 01:38

renovate Bot force-pushed the renovate/all branch 3 times, most recently from cf524ed to c056f30 Compare August 27, 2026 00:52

renovate Bot force-pushed the renovate/all branch 3 times, most recently from d9540d7 to a70e266 Compare September 7, 2026 17:14

renovate Bot force-pushed the renovate/all branch 3 times, most recently from 0d3030c to 8f6ff01 Compare September 15, 2026 12:10

chore(deps): update all dependencies

79023a9

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/all branch from 8f6ff01 to 79023a9 Compare September 15, 2026 22:09

Navigation Menu

Uh oh!

chore(deps): update all dependencies - #15

chore(deps): update all dependencies#15
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/all

renovate Bot commented May 9, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jun 19, 2026 •

edited

Loading

Uh oh!

socket-security Bot commented Jul 27, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

renovate Bot commented May 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v7.0.1

v7.0.0

v6.10.0

v5.0.1

🚀 Features

🐞 Bug Fixes

View changes on GitHub

v5.0.0

🚨 Breaking Changes

🚀 Features

🐞 Bug Fixes

Configuration

Uh oh!

socket-security Bot commented Jun 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

socket-security Bot commented Jul 27, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 9, 2026 •

edited

Loading

`v7.0.1`

`v7.0.0`

`v6.10.0`

`v5.0.1`

`v5.0.0`

socket-security Bot commented Jun 19, 2026 •

edited

Loading

socket-security Bot commented Jul 27, 2026 •

edited

Loading