Skip to content

build(deps-dev): bump the testing group across 1 directory with 3 updates#384

Merged
mergify[bot] merged 4 commits into
mainfrom
dependabot/npm_and_yarn/testing-3926fea3e4
May 18, 2026
Merged

build(deps-dev): bump the testing group across 1 directory with 3 updates#384
mergify[bot] merged 4 commits into
mainfrom
dependabot/npm_and_yarn/testing-3926fea3e4

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 15, 2026

Bumps the testing group with 3 updates in the / directory: @playwright/test, @vitest/coverage-v8 and vitest.

Updates @playwright/test from 1.59.1 to 1.60.0

Release notes

Sourced from @​playwright/test's releases.

v1.60.0

🌐 HAR recording on Tracing

tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:

await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.

🪝 Drop API

New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:

await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});
await page.locator('#dropzone').drop({
data: {
'text/plain': 'hello world',
'text/uri-list': 'https://example.com',
},
});

🎯 Aria snapshots

🛑 test.abort()

New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:

test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});

New APIs

Browser, Context and Page

... (truncated)

Commits

Updates @vitest/coverage-v8 from 4.1.4 to 4.1.6

Release notes

Sourced from @​vitest/coverage-v8's releases.

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits

Updates vitest from 4.1.4 to 4.1.6

Release notes

Sourced from vitest's releases.

v4.1.6

   🐞 Bug Fixes

   🏎 Performance

    View changes on GitHub

v4.1.5

   🚀 Experimental Features

   🐞 Bug Fixes

    View changes on GitHub
Commits
  • a8fd24c chore: release v4.1.6
  • 18af98c fix(browser): simplify orchestrator otel carrier (#10285)
  • 3188260 feat(browser): provide project reference in ToMatchScreenshotResolvePath (#...
  • e399846 chore: release v4.1.5
  • 7dc6d54 Revert "fix: respect diff config options in soft assertions (#8696)"
  • 9787ded fix: respect diff config options in soft assertions (#8696)
  • 325463a fix(ast-collect): recognize _vi_import prefix in static test discovery (#10...
  • 0e0ff41 feat(coverage): istanbul to support instrumenter option (#10119)
  • 663b99f fix: alias agent reporter to minimal (#10157)
  • 122c25b fix: fix vi.defineHelper called as object method (#10163)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added the dependencies Pull requests that update a dependency file label May 15, 2026
@julianken-bot
Copy link
Copy Markdown
Collaborator

@dependabot rebase

@dependabot dependabot Bot changed the title build(deps-dev): bump the testing group across 1 directory with 3 updates chore(deps-dev): bump the testing group across 1 directory with 3 updates May 18, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/testing-3926fea3e4 branch from 73e23a5 to dfae92e Compare May 18, 2026 00:57
@julianken-bot
Copy link
Copy Markdown
Collaborator

@dependabot recreate

@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/testing-3926fea3e4 branch from dfae92e to 02ed29a Compare May 18, 2026 01:02
@dependabot dependabot Bot changed the title chore(deps-dev): bump the testing group across 1 directory with 3 updates build(deps-dev): bump the testing group across 1 directory with 3 updates May 18, 2026
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/testing-3926fea3e4 branch from 02ed29a to e02dfca Compare May 18, 2026 01:06
…ates

Bumps the testing group with 3 updates in the / directory: [@playwright/test](https://github.com/microsoft/playwright), [@vitest/coverage-v8](https://github.com/vitest-dev/vitest/tree/HEAD/packages/coverage-v8) and [vitest](https://github.com/vitest-dev/vitest/tree/HEAD/packages/vitest).


Updates `@playwright/test` from 1.59.1 to 1.60.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.59.1...v1.60.0)

Updates `@vitest/coverage-v8` from 4.1.4 to 4.1.6
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/coverage-v8)

Updates `vitest` from 4.1.4 to 4.1.6
- [Release notes](https://github.com/vitest-dev/vitest/releases)
- [Commits](https://github.com/vitest-dev/vitest/commits/v4.1.6/packages/vitest)

---
updated-dependencies:
- dependency-name: "@playwright/test"
  dependency-version: 1.60.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: testing
- dependency-name: "@vitest/coverage-v8"
  dependency-version: 4.1.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: testing
- dependency-name: vitest
  dependency-version: 4.1.6
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: testing
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/npm_and_yarn/testing-3926fea3e4 branch from e02dfca to 216ea24 Compare May 18, 2026 01:09
julianken-bot
julianken-bot previously approved these changes May 18, 2026
Copy link
Copy Markdown
Collaborator

@julianken-bot julianken-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verdict: APPROVE

Verification ledger

  • gh pr view 384 — HEAD d1ad157 on dependabot/npm_and_yarn/testing-3926fea3e4, base fe7d830, mergeable, not draft.
  • gh pr diff 384 — 2 files: package.json (3 minor version bumps, dev-only), pnpm-lock.yaml (regenerated graph).
  • git log fe7d830..d1ad157 — 2 commits: Dependabot bump 216ea24, then Julian's lockfile fix d1ad157.
  • git show d1ad157 — fix touches 3 lines of pnpm-lock.yaml only; replaces sha256-hex patch_hash (Dependabot's pnpm 10+ output, 96ac089b...64chars) with base32 short hash nxvyby6r4isjnouuw656h2bwdi matching main and pnpm 9's hash format.
  • git diff fe7d830..d1ad157 -- patches/ — empty (patch file content unchanged, only the lockfile reference to it).
  • git show fe7d830:pnpm-lock.yaml | grep patch_hash — confirms main already uses base32 nxvyby6r4isjnouuw656h2bwdi (same value on disk now), so the fix restores byte-for-byte the same hash format CI expects.
  • pnpm --version9.15.9 locally; Dockerfile line 2 pins corepack prepare pnpm@9 --activate — runtime and lockfile format match.
  • gh pr view 384 --json statusCheckRollup — all 12 required checks SUCCESS (ESLint, TypeScript, Vitest, Next.js Build, Analyze Bundle, CodeQL, E2E Shards 1/4–4/4); CodeQL Analysis SUCCESS; Mergify queue NEUTRAL (expected, not yet queued).

Findings ToC

  • SUGGESTION: pin packageManager in package.json to prevent recurring Dependabot lockfile-format drift (followup, out of scope for this PR)

What's specifically right

  • The fix was scoped surgically: 3 lines of lockfile, no spec change, no package.json touch, no pnpm version change. That's the minimum diff that resolves the CI failure.
  • The chosen resolution path (local pnpm 9 regeneration) is the correct one — @dependabot recreate produced the wrong format because Dependabot's environment uses pnpm 10, and there is no way to override that from within a PR. Recognizing this and bypassing the recreate loop saved an iteration.
  • The patch file patches/next-view-transitions.patch itself was not modified — confirms the underlying patched dependency content is unchanged; only the hash representation differs between pnpm versions, not the patch content.

Bottom line

Single-commit fix on top of a clean Dependabot devDependency bump (3 testing packages, all minor). CI fully green on the post-fix HEAD. Safe to queue.

@julianken-bot (opus, fresh context)

Comment thread package.json
@@ -49,7 +49,7 @@
"devDependencies": {
"@ai-sdk/openai": "^1",
Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

SUGGESTION — followup, not blocking this PR.

This same CI failure will recur on every Dependabot dev-deps PR as long as Dependabot's bot environment uses a different pnpm major than main's lockfile. Each future Dependabot PR will regenerate patch_hash here in pnpm 10's sha256-hex format and break --frozen-lockfile.

Structural fix (separate followup PR): add a packageManager: "pnpm@9.15.9" field to package.json. Once that's present, corepack will force Dependabot's own CI to use pnpm 9 when it runs pnpm install on the bumped branch, so the regenerated hash will already be in the base32 format matching main and the Dockerfile — no Julian-side manual regeneration needed.

R9 note: this is plan-controlled (a repo-level Dependabot/toolchain decision), not implementer-controlled for this PR. Filing here as a SUGGESTION because the friction is recurring and the fix is mechanical (one line + a Dependabot config update).

@julianken-bot
Copy link
Copy Markdown
Collaborator

@Mergifyio queue

@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented May 18, 2026

Merge Queue Status

🛑 Queue command has been cancelled

julianken-bot
julianken-bot previously approved these changes May 18, 2026
Copy link
Copy Markdown
Collaborator

@julianken-bot julianken-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verdict: APPROVE (re-review after rebase + lockfile regen)

Verification ledger

  • gh pr view 384 — HEAD 36dbff2 on dependabot/npm_and_yarn/testing-3926fea3e4, base 65febfb, mergeable, not draft. Prior bot APPROVE on d1ad157 was dismissed when the merge commit landed (branch-protection behavior, expected).
  • git log fe7d830..36dbff2 — branch history: 216ea24 Dependabot bump → d1ad157 Julian lockfile fix (pnpm 9 base32 hash) → 36dbff2 merge of origin/main (carrying #372 graphql + #222 jsdom). Merge author Julian via noreply email; conflict in pnpm-lock.yaml only, as stated.
  • git diff origin/main..36dbff2 --stat — 2 files: package.json (+3/-3) and pnpm-lock.yaml (+131/-129). Diff vs current main matches the dispatcher's claim exactly: testing-group package.json bumps + reconciled lockfile.
  • git diff origin/main..36dbff2 -- package.json — exactly 3 specifier bumps: @playwright/test ^1.59.1^1.60.0, @vitest/coverage-v8 ^4.1.4^4.1.6, vitest ^4.1.4^4.1.6. No additions or removals.
  • Lockfile transitives audit — playwright/playwright-core 1.59→1.60 (direct), plus vitest 4.1.6's closure: magicast 0.5.2→0.5.3, tinyexec 1.0.2→1.1.2, es-module-lexer 2.0.0→2.1.0, semver 7.7.4→7.8.0, @babel/parser@7.29.3 added, @types/estree@1.0.9 added, picomatch@4.0.3 removed (4.0.4 retained), tinyglobby@0.2.15 removed (0.2.16 retained). All consistent with the testing-group bumps; no unrelated package movement, no resurrection of graphql@16.13.2 or jsdom@29.0.2 (proves clean merge with the freshly-landed #372 / #222).
  • git diff origin/main..36dbff2 -- patches/ — empty. patches/next-view-transitions.patch untouched.
  • patch_hash check — git show origin/main:pnpm-lock.yaml | grep patch_hash and git show 36dbff2:pnpm-lock.yaml | grep patch_hash both show patch_hash=nxvyby6r4isjnouuw656h2bwdi (pnpm 9 base32 format). The CI hash-format regression that motivated the rebase is resolved.
  • pnpm --version locally → 9.15.9; Dockerfile pins corepack prepare pnpm@9 --activate. Runtime and lockfile format agree.
  • gh pr checks 384 — all 12 required checks SUCCESS on 36dbff2: ESLint, TypeScript, Vitest, Next.js Build, Analyze Bundle, CodeQL, CodeQL Analysis, E2E Shards 1/4–4/4. Mergify queue NEUTRAL (expected; not yet queued).
  • gh api .../collaborators/julianken-bot/permissionwrite (APPROVE event valid).

Findings ToC

  • SUGGESTION: pin packageManager: "pnpm@9.15.9" in package.json — would prevent the pnpm 9 vs 10 lockfile-format drift that caused this whole rebase round. Follow-up, out of scope here.

What's specifically right

  • The merge commit is a true rebase-via-merge: only conflict was pnpm-lock.yaml, and the regenerated lockfile reconciles cleanly with both the upstream graphql/jsdom bumps and the local testing-group bump. No "let's also touch unrelated config while we're here" drift.
  • The patch_hash format (nxvyby6r4isjnouuw656h2bwdi, base32) is byte-identical to main. This is the load-bearing detail — it's why CI flipped from red on Dependabot's sha256-hex regenerate to green here.
  • Diff vs current main is exactly the two files the dispatch claimed. The merge commit's mechanical 4-file diff (which includes workflow files brought in from main) reconciles to a 2-file delta against main. Verified independently from the diff command, not trusted from narrative.

Bottom line

Same content as the prior APPROVE (d1ad157), now rebased atop a moved main with the lockfile re-reconciled. CI fully green on the post-rebase HEAD. Safe to queue.

@julianken-bot (opus, fresh context)

@julianken-bot
Copy link
Copy Markdown
Collaborator

@Mergifyio queue

@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented May 18, 2026

Merge Queue Status

  • 🟠 Waiting for queue conditions
  • ⏳ Enter queue
  • ⏳ Run checks
  • ⏳ Merge
Required conditions to enter a queue
  • -closed [📌 queue requirement]
  • -conflict [📌 queue requirement]
  • -draft [📌 queue requirement]
  • any of [📌 queue -> configuration change requirements]:
    • -mergify-configuration-changed
    • check-success = Configuration changed
  • any of [🔀 queue conditions]:
    • all of [📌 queue conditions of queue rule default]:
      • #approved-reviews-by >= 1
      • #approved-reviews-by >= 1 [🛡 GitHub branch protection]
      • #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
      • -conflict
      • -draft
      • base = main
      • check-success = Analyze Bundle
      • check-success = CodeQL Analysis
      • check-success = E2E Shard 1/4
      • check-success = E2E Shard 2/4
      • check-success = E2E Shard 3/4
      • check-success = E2E Shard 4/4
      • check-success = ESLint
      • check-success = Next.js Build
      • check-success = TypeScript
      • check-success = Vitest
      • github-review-decision = APPROVED [🛡 GitHub branch protection]
      • any of [🛡 GitHub branch protection]:
        • check-success = ESLint
        • check-neutral = ESLint
        • check-skipped = ESLint
      • any of [🛡 GitHub branch protection]:
        • check-success = TypeScript
        • check-neutral = TypeScript
        • check-skipped = TypeScript
      • any of [🛡 GitHub branch protection]:
        • check-success = Vitest
        • check-neutral = Vitest
        • check-skipped = Vitest
      • any of [🛡 GitHub branch protection]:
        • check-success = Next.js Build
        • check-neutral = Next.js Build
        • check-skipped = Next.js Build
      • any of [🛡 GitHub branch protection]:
        • check-success = Analyze Bundle
        • check-neutral = Analyze Bundle
        • check-skipped = Analyze Bundle
      • any of [🛡 GitHub branch protection]:
        • check-success = CodeQL Analysis
        • check-neutral = CodeQL Analysis
        • check-skipped = CodeQL Analysis
      • any of [🛡 GitHub branch protection]:
        • check-success = E2E Shard 1/4
        • check-neutral = E2E Shard 1/4
        • check-skipped = E2E Shard 1/4
      • any of [🛡 GitHub branch protection]:
        • check-success = E2E Shard 2/4
        • check-neutral = E2E Shard 2/4
        • check-skipped = E2E Shard 2/4
      • any of [🛡 GitHub branch protection]:
        • check-success = E2E Shard 3/4
        • check-neutral = E2E Shard 3/4
        • check-skipped = E2E Shard 3/4
      • any of [🛡 GitHub branch protection]:
        • check-success = E2E Shard 4/4
        • check-neutral = E2E Shard 4/4
        • check-skipped = E2E Shard 4/4

Copy link
Copy Markdown
Collaborator

@julianken-bot julianken-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Verdict: APPROVE — second rebase reconciles cleanly; diff vs main is still just the testing-group bump and a regenerated lockfile, and all checks I ran locally pass.

What I verified (this turn)

  • git diff origin/main..pr-384 -- package.json → only the three intended specifier bumps (@playwright/test 1.59.1→1.60.0, @vitest/coverage-v8 and vitest 4.1.4→4.1.6); no other devDependency or pnpm.patchedDependencies lines touched.
  • git diff origin/main..pr-384 --stat → 2 files (package.json, pnpm-lock.yaml); 17 lockfile entries added, 17 removed (clean swap, no orphans). All added entries are within the testing-group transitive closure (@playwright/*, playwright-core, @vitest/* cluster, magicast@0.5.3, @babel/parser@7.29.3, es-module-lexer@2.1.0, semver@7.8.0, tinyexec@1.1.2) — verified magicast@0.5.3 pulls @babel/parser@7.29.3 per its lockfile dependencies block.
  • git log 5cf65e9e ^36dbff2092 → the new merge commit is solely the origin/main integration (brings in #129 payload + #131 tailwind from the now-merged ahead-of-#384 work); authored by Julian <14049295+julianken@users.noreply.github.com> as expected.
  • pnpm install --frozen-lockfile --prefer-offline (in a /tmp worktree at head 5cf65e9e) → resolves cleanly with @playwright/test 1.60.0, @vitest/coverage-v8 4.1.6, vitest 4.1.6 (Done in 6.7s); patch hash nxvyby6r4isjnouuw656h2bwdi for next-view-transitions unchanged, so #383's pnpm patch is still applied.
  • pnpm exec vitest runTest Files 37 passed (37) / Tests 584 passed (584) / Duration 6.54s on vitest 4.1.6.
  • pnpm exec tsc --noEmit → 0 errors. pnpm exec eslint . → 0 errors, 18 pre-existing warnings unrelated to this PR.
  • gh api repos/julianken/detached-node/collaborators/julianken-bot/permissionwrite (APPROVE event will land).

Findings (0 — see inline comments below for detail)

None. Mandatory second-pass read surfaced no real issues. The merge commit is a pure conflict-resolution-by-regeneration of the lockfile; the package.json delta vs main is exactly the three Dependabot-intended specifier bumps; the @babel/parser / magicast / es-module-lexer transitive shuffle is internally consistent with the vitest cluster moving 4.1.4→4.1.6; the pnpm.patchedDependencies config and patch hash are preserved.

Bottom line: ready to merge. Note that #369 (next-react group) and #314 (ai-sdk group) remain open — whichever of those merges next will displace this PR's lockfile state again, so prefer to queue this PR sooner rather than later.


Reviewer: @julianken-bot (opus) — fresh-context subagent dispatched via the reviewing-as-julianken-bot skill. Verdict above is binding regardless of GitHub's review label.

@julianken-bot
Copy link
Copy Markdown
Collaborator

@Mergifyio queue

@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented May 18, 2026

queue

☑️ Command queue ignored because it is already running from a previous command.

@mergify mergify Bot added the queued label May 18, 2026
@mergify
Copy link
Copy Markdown
Contributor

mergify Bot commented May 18, 2026

Merge Queue Status

  • Entered queue2026-05-18 02:29 UTC · Rule: default
  • Checks skipped · PR is already up-to-date
  • Merged2026-05-18 02:31 UTC · at 5cf65e9e68884301b7a1fb0c90f4616f1928d48a · squash

This pull request spent 1 minute 27 seconds in the queue, including 9 seconds running CI.

Required conditions to merge
  • #approved-reviews-by >= 1 [🛡 GitHub branch protection]
  • #changes-requested-reviews-by = 0 [🛡 GitHub branch protection]
  • github-review-decision = APPROVED [🛡 GitHub branch protection]
  • any of [🛡 GitHub branch protection]:
    • check-success = ESLint
    • check-neutral = ESLint
    • check-skipped = ESLint
  • any of [🛡 GitHub branch protection]:
    • check-success = TypeScript
    • check-neutral = TypeScript
    • check-skipped = TypeScript
  • any of [🛡 GitHub branch protection]:
    • check-success = Vitest
    • check-neutral = Vitest
    • check-skipped = Vitest
  • any of [🛡 GitHub branch protection]:
    • check-success = Next.js Build
    • check-neutral = Next.js Build
    • check-skipped = Next.js Build
  • any of [🛡 GitHub branch protection]:
    • check-success = Analyze Bundle
    • check-neutral = Analyze Bundle
    • check-skipped = Analyze Bundle
  • any of [🛡 GitHub branch protection]:
    • check-success = CodeQL Analysis
    • check-neutral = CodeQL Analysis
    • check-skipped = CodeQL Analysis
  • any of [🛡 GitHub branch protection]:
    • check-success = E2E Shard 1/4
    • check-neutral = E2E Shard 1/4
    • check-skipped = E2E Shard 1/4
  • any of [🛡 GitHub branch protection]:
    • check-success = E2E Shard 2/4
    • check-neutral = E2E Shard 2/4
    • check-skipped = E2E Shard 2/4
  • any of [🛡 GitHub branch protection]:
    • check-success = E2E Shard 3/4
    • check-neutral = E2E Shard 3/4
    • check-skipped = E2E Shard 3/4
  • any of [🛡 GitHub branch protection]:
    • check-success = E2E Shard 4/4
    • check-neutral = E2E Shard 4/4
    • check-skipped = E2E Shard 4/4

@mergify mergify Bot merged commit ec7099b into main May 18, 2026
13 checks passed
@mergify mergify Bot deleted the dependabot/npm_and_yarn/testing-3926fea3e4 branch May 18, 2026 02:31
@mergify mergify Bot removed the queued label May 18, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Pull requests that update a dependency file

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants