chore(deps-dev): bump the development group with 7 updates by dependabot[bot] · Pull Request #2371 · expressjs/expressjs.com

dependabot · 2026-06-03T00:35:42Z

Bumps the development group with 7 updates:

Package	From	To
@iconify-json/fluent	`1.2.41`	`1.2.48`
@playwright/test	`1.59.1`	`1.60.0`
@types/node	`25.3.2`	`25.9.1`
lint-staged	`16.2.7`	`17.0.7`
postcss-custom-media	`12.0.0`	`12.0.1`
typescript	`5.9.3`	`6.0.3`
vite-plugin-svgr	`4.5.0`	`5.2.0`

Updates @iconify-json/fluent from 1.2.41 to 1.2.48

Commits

See full diff in compare view

Updates @playwright/test from 1.59.1 to 1.60.0

Release notes

Sourced from @playwright/test's releases.

v1.60.0

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:
await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.
🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:
await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});
await page.locator('#dropzone').drop({
data: {
'text/plain': 'hello world',
'text/uri-list': 'https://example.com',
},
});
🎯 Aria snapshots

expect(page).toMatchAriaSnapshot() now works on a Page, in addition to a Locator — equivalent to asserting against page.locator('body').

New boxes option on locator.ariaSnapshot() / page.ariaSnapshot() appends each element's bounding box as [box=x,y,width,height], useful for AI consumption.

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:
test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});
New APIs

Browser, Context and Page

... (truncated)

Commits

87bb9dd cherry-pick(#40747): fix(yauzl): vendor yauzl with destroy-lifecycle fix
9a9c51c cherry-pick(#40733): chore(electron): revert #40184 (move Electron API to a s...
4b3b628 cherry-pick(#40736): Revert "feat(electron): add timeout option to electronAp...
f869f96 chore: bump version to v1.60.0 (#40714)
7eb6918 cherry-pick(#40710): docs: release notes v1.60
118d2aa cherry-pick(#40693): chore(python): formdata path type
54012f5 chore(deps): bump ip-address and express-rate-limit (#40680)
9fa531d fix(screencast): unblock frame ack when an async client disconnects (#40674)
3649db5 chore(mcp): bump default extension protocol to v2 (#40678)
bb6c009 chore(extension): mark 0.2.1 (#40679)
Additional commits viewable in compare view

Updates @types/node from 25.3.2 to 25.9.1

Commits

See full diff in compare view

Updates lint-staged from 16.2.7 to 17.0.7

Release notes

Sourced from lint-staged's releases.

v17.0.7

Patch Changes

#1806 e692e58 - Update dependency tinyexec@^1.2.4.

v17.0.6

Patch Changes

#1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

#1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

#1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

#1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

v17.0.5

Patch Changes

#1792 1f67271 - Correctly set the --max-arg-length default value based on the running platform. This controls how very long lists of staged files are split into multiple chunks.

v17.0.4

Patch Changes

#1788 f95c1f8 - Another fix for making sure lint-staged adds task modifications correctly to the commit in the following cases:

after editing <file> it is staged with git add <file>, and then committed with git commit

after editing <file> it is committed with git commit --all without explicit git add

after editing <file> it is committed with git commit <pathspec> without explicit git add

There's new test cases which actually setup the Git pre_commit hook to run lint-staged and verify them. These issues started in v17.0.0 when trying to improve support for committig without having explicitly staged files.

v17.0.3

Patch Changes

#1782 06813f9 Thanks @iiroj! - Fix lint-staged behavior when implicitly committing files without using git add by either:

git commit -am "my commit message" where -a (--all) means to automatically stage all tracked modified and deleted files

git commit -m "my commit message" . where . is an example of a pathspec where matching files will be staged

v17.0.2

Patch Changes

#1779 88670ca Thanks @iiroj! - Enable immutable GitHub releases

v17.0.1

Patch Changes

#1776 4a5664b Thanks @iiroj! - Adjust GitHub Actions workflow so that automatic publishing works with signed commits.

v17.0.0

... (truncated)

Changelog

Sourced from lint-staged's changelog.

17.0.7

Patch Changes

#1806 e692e58 - Update dependency tinyexec@^1.2.4.

17.0.6

Patch Changes

#1803 bdf2770 - Run all tests with Deno, in addition to Node.js and Bun.

#1796 7508272 - Fix performance regression of lint-staged v17 by going back to using git add to stage task modifications. This was changed to git update-index --again in v17 for less manual work, but unfortunately the update-index command gets slower in very large Git repos.

#1797 7b2505a - This version of lint-staged uses the new staged publishing for npm packages feature. Releases are already published from GitHub Actions with trusted publishing, but now an additional approval with two-factor authentication is also required.

#1802 321b0a9 - Downgrade dependency tinyexec@1.2.2 to avoid issues in version 1.2.3.

17.0.5

Patch Changes

#1792 1f67271 - Correctly set the --max-arg-length default value based on the running platform. This controls how very long lists of staged files are split into multiple chunks.

17.0.4

Patch Changes

#1788 f95c1f8 - Another fix for making sure lint-staged adds task modifications correctly to the commit in the following cases:

after editing <file> it is staged with git add <file>, and then committed with git commit

after editing <file> it is committed with git commit --all without explicit git add

after editing <file> it is committed with git commit <pathspec> without explicit git add

There's new test cases which actually setup the Git pre_commit hook to run lint-staged and verify them. These issues started in v17.0.0 when trying to improve support for committig without having explicitly staged files.

17.0.3

Patch Changes

#1782 06813f9 Thanks @iiroj! - Fix lint-staged behavior when implicitly committing files without using git add by either:

git commit -am "my commit message" where -a (--all) means to automatically stage all tracked modified and deleted files

git commit -m "my commit message" . where . is an example of a pathspec where matching files will be staged

17.0.2

Patch Changes

#1779 88670ca Thanks @iiroj! - Enable immutable GitHub releases

17.0.1

... (truncated)

Commits

cd11fec Merge pull request #1807 from lint-staged/changeset-release/main
15a8ee0 chore(changeset): release
797bbd9 Merge pull request #1808 from lint-staged/add-stashing-faq
504e307 docs: add FAQ entry on how stashing works
eff5cd1 Merge pull request #1806 from lint-staged/update-tinyexec
e692e58 build(deps): update tinyexec@^1.2.4
a2dd4ea Merge pull request #1805 from lint-staged/update-github-templates
c928519 docs: update GitHub templates
094ba56 Merge pull request #1798 from lint-staged/changeset-release/main
88e19fe chore(changeset): release
Additional commits viewable in compare view

Updates postcss-custom-media from 12.0.0 to 12.0.1

Changelog

Sourced from postcss-custom-media's changelog.

12.0.1

February 21, 2026

Fix importance of custom media in anonymous cascade layers.

Commits

See full diff in compare view

Updates typescript from 5.9.3 to 6.0.3

Release notes

Sourced from typescript's releases.

TypeScript 6.0.3

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

fixed issues query for TypeScript 6.0.3 (Stable).

Downloads are available on:

npm

TypeScript 6.0

For release notes, check out the release announcement blog post.

fixed issues query for TypeScript 6.0.0 (Beta).

fixed issues query for TypeScript 6.0.1 (RC).

fixed issues query for TypeScript 6.0.2 (Stable).

Downloads are available on:

npm

TypeScript 6.0 Beta

For release notes, check out the release announcement.

fixed issues query for Typescript 6.0.0 (Beta).

Downloads are available on:

npm

Commits

050880c Bump version to 6.0.3 and LKG
eeae9dd 🤖 Pick PR #63401 (Also check package name validity in...) into release-6.0 (#...
ad1c695 🤖 Pick PR #63368 (Harden ATA package name filtering) into release-6.0 (#63372)
0725fb4 🤖 Pick PR #63310 (Mark class property initializers as...) into release-6.0 (#...
607a22a Bump version to 6.0.2 and LKG
9e72ab7 🤖 Pick PR #63239 (Fix missing lib files in reused pro...) into release-6.0 (#...
35ff23d 🤖 Pick PR #63163 (Port anyFunctionType subtype fix an...) into release-6.0 (#...
e175b69 Bump version to 6.0.1-rc and LKG
af4caac Update LKG
8efd7e8 Merge remote-tracking branch 'origin/main' into release-6.0
Additional commits viewable in compare view

Updates vite-plugin-svgr from 4.5.0 to 5.2.0

Release notes

Sourced from vite-plugin-svgr's releases.

v5.2.0

No significant changes

    View changes on GitHub

v5.1.0

   🐞 Bug Fixes

Correct OxcTransformOptions type to expose jsx options - by @rivajunior in pd4d10/vite-plugin-svgr#144 (0ca4f)

   🏎 Performance

Lazy load SVGR dependencies - by @pd4d10 (8aadc)

    View changes on GitHub

v5.0.0

   🚨 Breaking Changes

Drop vite 2 support and add vite compat tests - by @pd4d10 (d19af)

    View changes on GitHub

Commits

8ff69f4 5.2.0
dfbcb3b build: export cjs entry as callable default
127eea3 chore: upgrade toolchain dependencies
765a674 build: make TypeScript root dirs explicit
9c0bdca ci: add publint workflow
1b19812 build: switch to tsdown for dual-module output
0605cf7 5.1.0
f598866 test: fix TypeScript typings
8aadc43 perf: lazy load SVGR dependencies
0ca4f6b fix: correct OxcTransformOptions type to expose jsx options (#144)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

Bumps the development group with 7 updates: | Package | From | To | | --- | --- | --- | | [@iconify-json/fluent](https://github.com/iconify/icon-sets) | `1.2.41` | `1.2.48` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.59.1` | `1.60.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.3.2` | `25.9.1` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `16.2.7` | `17.0.7` | | [postcss-custom-media](https://github.com/csstools/postcss-plugins/tree/HEAD/plugins/postcss-custom-media) | `12.0.0` | `12.0.1` | | [typescript](https://github.com/microsoft/TypeScript) | `5.9.3` | `6.0.3` | | [vite-plugin-svgr](https://github.com/pd4d10/vite-plugin-svgr) | `4.5.0` | `5.2.0` | Updates `@iconify-json/fluent` from 1.2.41 to 1.2.48 - [Commits](https://github.com/iconify/icon-sets/commits) Updates `@playwright/test` from 1.59.1 to 1.60.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.59.1...v1.60.0) Updates `@types/node` from 25.3.2 to 25.9.1 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `lint-staged` from 16.2.7 to 17.0.7 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v16.2.7...v17.0.7) Updates `postcss-custom-media` from 12.0.0 to 12.0.1 - [Changelog](https://github.com/csstools/postcss-plugins/blob/main/plugins/postcss-custom-media/CHANGELOG.md) - [Commits](https://github.com/csstools/postcss-plugins/commits/HEAD/plugins/postcss-custom-media) Updates `typescript` from 5.9.3 to 6.0.3 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v5.9.3...v6.0.3) Updates `vite-plugin-svgr` from 4.5.0 to 5.2.0 - [Release notes](https://github.com/pd4d10/vite-plugin-svgr/releases) - [Commits](pd4d10/vite-plugin-svgr@v4.5.0...v5.2.0) --- updated-dependencies: - dependency-name: "@iconify-json/fluent" dependency-version: 1.2.48 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: "@playwright/test" dependency-version: 1.60.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development - dependency-name: "@types/node" dependency-version: 25.9.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: development - dependency-name: lint-staged dependency-version: 17.0.7 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development - dependency-name: postcss-custom-media dependency-version: 12.0.1 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: development - dependency-name: typescript dependency-version: 6.0.3 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development - dependency-name: vite-plugin-svgr dependency-version: 5.2.0 dependency-type: direct:development update-type: version-update:semver-major dependency-group: development ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-06-03T00:36:39Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
@iconify-json/fluent@1.2.41 ⏵ 1.2.48			⁺¹
@types/node@25.3.2 ⏵ 25.9.1	⁺¹	⁺¹
vite-plugin-svgr@4.5.0 ⏵ 5.2.0		⁺²
postcss-custom-media@12.0.0 ⏵ 12.0.1
typescript@5.9.3 ⏵ 6.0.3	⁺¹	⁺¹
lint-staged@16.2.7 ⏵ 17.0.7	⁺¹
@playwright/test@1.59.1 ⏵ 1.60.0

View full report

netlify · 2026-06-03T00:37:35Z

❌ Deploy Preview for expressjscom-preview failed.

Name	Link
🔨 Latest commit	`9dca914`
🔍 Latest deploy log	https://app.netlify.com/projects/expressjscom-preview/deploys/6a1f76e0bfd1eb000878bfd1

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 3, 2026

dependabot Bot requested a review from a team as a code owner June 3, 2026 00:35

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jun 3, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps-dev): bump the development group with 7 updates#2371

chore(deps-dev): bump the development group with 7 updates#2371
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/development-ebdb5685f4

dependabot Bot commented on behalf of github Jun 3, 2026

Uh oh!

socket-security Bot commented Jun 3, 2026

Uh oh!

netlify Bot commented Jun 3, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Jun 3, 2026

v1.60.0

🌐 HAR recording on Tracing

🪝 Drop API

🎯 Aria snapshots

🛑 test.abort()

New APIs

Browser, Context and Page

v17.0.7

Patch Changes

v17.0.6

Patch Changes

v17.0.5

Patch Changes

v17.0.4

Patch Changes

v17.0.3

Patch Changes

v17.0.2

Patch Changes

v17.0.1

Patch Changes

v17.0.0

17.0.7

Patch Changes

17.0.6

Patch Changes

17.0.5

Patch Changes

17.0.4

Patch Changes

17.0.3

Patch Changes

17.0.2

Patch Changes

17.0.1

12.0.1

TypeScript 6.0.3

TypeScript 6.0

TypeScript 6.0 Beta

v5.2.0

View changes on GitHub

v5.1.0

🐞 Bug Fixes

🏎 Performance

View changes on GitHub

v5.0.0

🚨 Breaking Changes

View changes on GitHub

Uh oh!

socket-security Bot commented Jun 3, 2026

Uh oh!

netlify Bot commented Jun 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

❌ Deploy Preview for expressjscom-preview failed.

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

netlify Bot commented Jun 3, 2026 •

edited

Loading