fix(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
@figma/plugin-typings	^1.130.0 → ^1.134.0
@modelcontextprotocol/sdk (source)	^1.29.0 → ^1.30.0
@rollup/plugin-terser>serialize-javascript	7.0.7 → 7.1.0
@tsconfig/node24 (source)	^24.0.4 → ^24.0.5
@vitejs/plugin-vue (source)	^6.0.7 → ^6.0.8
@vitejs/plugin-vue (source)	6.0.7 → 6.0.8
@vueuse/core (source)	^14.3.0 → ^14.4.0
esbuild	0.28.1 → 0.28.2
esbuild	^0.28.1 → ^0.28.2
eslint (source)	^10.7.0 → ^10.8.1
eslint-plugin-perfectionist (source)	^5.10.0 → ^5.10.1
eslint-plugin-vue (source)	~10.9.2 → ~10.10.0
eslint-plugin-vue (source)	^10.9.2 → ^10.10.0
marked (source)	^18.0.6 → ^18.0.9
nanoid	^6.0.0 → ^6.0.1
oxfmt (source)	^0.58.0 → ^0.63.0
p-limit	^7.3.0 → ^7.3.1
playwright (source)	^1.61.1 → ^1.62.1
pnpm (source)	11.11.0 → 11.21.0
tsdown (source)	^0.22.7 → ^0.22.14
tsx (source)	^4.23.1 → ^4.23.12
vite (source)	8.1.4 → 8.2.1
vite-plugin-css-injected-by-js	^5.0.1 → ^5.0.2
vue (source)	^3.5.39 → ^3.5.41
vue-tsc (source)	^3.3.7 → ^3.3.10
ws	^8.21.0 → ^8.21.3
wxt (source)	^0.20.27 → ^0.21.4

---

Release Notes

figma/plugin-typings (@​figma/plugin-typings)

v1.134.0

Compare Source

v1.133.0

Compare Source

v1.132.0

Compare Source

v1.131.0

Compare Source

modelcontextprotocol/typescript-sdk (@​modelcontextprotocol/sdk)

v1.30.0

Compare Source

yahoo/serialize-javascript (@​rollup/plugin-terser>serialize-javascript)

v7.1.0

Compare Source

What's Changed

• feat: add Node.js 26 to test matrix by @​okuryu in #​224
• release: v7.1.0 by @​okuryu in #​225

Full Changelog: yahoo/serialize-javascript@v7.0.7...v7.1.0

tsconfig/bases (@​tsconfig/node24)

v24.0.5

Compare Source

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.8

Features

• plugin-vue: add forced vapor mode option (#​766) (d59c3c0)

Bug Fixes

• deps: update all non-major dependencies (#​781) (d369e5a)

vueuse/vueuse (@​vueuse/core)

v14.4.0

Compare Source

   🚀 Features

• Update skills  -  by @​OrbisK in #​5491 (f4758)
• nuxt: Disable useColorMode auto import if @nuxtjs/color-mode is detected  -  by @​OrbisK in #​5476 (60687)
• nuxt: Generate nuxt module builder output layout  -  by @​userquin and @​43081j in #​5503 (40a1f)
• onStartTyping: Add more configurable options for onStartTyping  -  by @​LightQuanta and @​9romise in #​5395 (1f2b7)
• useDebounceFn: Add flush and isPending to filter system  -  by @​pcoterecollective, @​OrbisK and @​antfu in #​5259 (4aa18)
• useElementOverflow: New function  -  by @​inside5545, 苏俊言, @​antfu, @​ilyaliao, @​OrbisK, @​43081j and @​9romise in #​4094 (d49f5)
• useSpeechRecognition: Expose confidence of latest result  -  by @​SAY-5 in #​5398 (17dc9)
• useVirtualList: Add options behavior, block and inline to exposed scrollTo method  -  by @​laurens94, @​OrbisK, @​43081j and @​ilyaliao in #​4905 (01875)

   🐞 Bug Fixes

• Drop unnecessary PURE annotation to avoid Rollup warning  -  by @​serkodev and @​9romise in #​5388 (16933)
• Accept array template ref bound to v-for as observer target  -  by @​eldardada in #​5514 (bccb1)
• Reintroduce package normalisation to nuxt package  -  by @​43081j in #​5551 (c04c4)
• docs: Fix typo 'feedbacks' to 'feedback' in work-with-ai.md  -  by @​firstquarterlee in #​5447 (a4253)
• nuxt: Register formatTimeAgo variants for auto-import  -  by @​ilyaliao, @​cursoragent and Claude Opus 5 in #​5492 (8a908)
• skills: Correct broken relative links in generated function references  -  by @​lazerg and @​OrbisK in #​5549 (910db)
• tests: Deduplicate ci test runs  -  by @​Tofandel in #​5509 (5b272)
• useBrowserLocation: Skip write-back watching on 'load' state  -  by @​Tobias-Braun and @​9romise in #​5485 (fbdd2)
• useDraggable: End drag on pointercancel  -  by @​ShreeBohara and Claude Opus 5 in #​5550 (6aa9d)
• useElementSize: Prefill size based on box option  -  by @​meta-syntax in #​5524 (5fe49)
• useEventBus: Use tryOnScopeDispose to avoid operating Vue internal API  -  by @​liangmiQwQ in #​5548 (2cad7)
• useFetch: Ignore stale abort error after refetch succeeds  -  by @​lazerg in #​5525 (84426)
• useFuse: Trigger fuse ref after setCollection  -  by @​ilyaliao, Claude Opus 5 and @​cursoragent in #​5479 (3e10c)
• useGamepad: Keep updating remaining gamepads after one disconnects  -  by @​lazerg in #​5523 (65328)
• usePointerSwipe: Handle pointercancel event to reset state and trigger onSwipeEnd  -  by @​DORI2001, Dor Alagem and @​43081j in #​5379 (4c08a)
• useStyleTag: Avoid error when multiple components share the same id  -  by @​ben-lau in #​5473 (6d913)
• useVibrate: Make interval option optional  -  by @​Aluomolo in #​5490 (305ee)
• useVirtualList: Recompute range when item size changes  -  by @​Antreesy in #​5533 (0f6d5)
• useWebSocket: Sync status to 'CLOSED' after explicit close()  -  by @​WuMingDao and @​OrbisK in #​5471 (351bf)

    View changes on GitHub

evanw/esbuild (esbuild)

v0.28.2

Compare Source

• Fix tree shaking bug due to TypeScript import alias (#​4507)

  This release fixes a bug that could cause esbuild to incorrectly tree-shake imports that are used in a TypeScript type alias under certain circumstances. Affected code uses a TypeScript-specific import assignment and looks something like this:

  import Base from './dep.js';
  import Alias = Base.SomeType;

• Fix CSS minification bug involving & (#​4497)

  This release fixes a bug where esbuild's CSS minifier incorrectly removed a & when it was unsafe to do so. Here is an example:

  /* Original code */
  .a .b {
    & .b:not(& .c) {
      color: red;
    }
  }
  
  /* Old output (with --minify) */
  .a .b{.b:not(& .c){color:red}}
  
  /* New output (with --minify) */
  .a .b{& .b:not(& .c){color:red}}

  This should match <span class="a"><span class="b"><span class="b">yes</span></span></span> but not <span class="a"><span class="b">no</span></span>. The old output incorrectly matched both.

• Avoid overwriting input files without --allow-overwrite (#​4484)

  For example: esbuild input.js --outfile=input.js tells esbuild to overwrite input.js with the output of running esbuild on it. This was supposed to already be prevented by default, but it accidentally regressed in version 0.17.0 and apparently didn't have any test coverage. The error message was being printed but the input file was still being overwritten. Oops.

  This release puts the original behavior back. With this release, esbuild should now actually avoid overwriting input files unless --allow-overwrite is explicitly present. This is done by not writing out any files when a build error is encountered.

• Fix incorrect code generated when using top-level await (#​4498)

  Previously esbuild could generate code containing a syntax error in complex scenarios involving top-level await used in a dependency cycle. The problem was a missing async on one or more module wrapper closures. With this release, esbuild now uses a fixed-point iteration algorithm to correctly annotate all dependencies in the cycle as needing an async module wrapper.

• Fix a minification bug with lowered logical assignment operators (#​4508)

  This release fixes a bug that could cause esbuild to generate incorrect code for logical assignment operators when lowering them to an older target environment. Specifically the lowering process requires duplicating the left-hand side, but esbuild incorrectly failed to count the duplicate as a new usage when the left-hand side is an identifier. That then caused the minifier to believe that the left-hand side was only used once and could attempt to incorrectly inline an initializer into the first usage. This bug has now been fixed:

  // Original code
  function foo() {
    let x
    bar(x ||= {})
  }
  
  // Old output (with --minify-syntax --target=es6)
  function foo() {
    bar(void 0 || (x = {}));
  }
  
  // New output (with --minify-syntax --target=es6)
  function foo() {
    let x;
    bar(x || (x = {}));
  }

• Fix a potential deadlock when the JavaScript API is used incorrectly (#​4503, #​4506)

  The JavaScript API runs the native esbuild executable as a long-lived child process and communicates with it over stdin/stdout/stderr. Each API request is asynchronous and the executable stays open as long as it has work to do, which is as long as either stdin is still open (meaning there may be more API requests) or there are currently requests being processed.

  Previously esbuild's tracking of outstanding API requests missed decrementing a reference count in an edge case where esbuild's JavaScript API was used incorrectly and the API request returned an error. This could in some cases cause esbuild's native executable to exit with an error message about a deadlock. This release fixes the reference counting bug.

  This fix was submitted by @​ZuBB.

• Handle target collisions (#​4509)

  It's possible to specify the same target engine multiple times, such as with --target=chrome1,chrome99. This edge case wasn't anticipated and previously took the last version for the duplicated target engine instead of the minimum version (so chrome99 in this case instead of chrome1). With this release, esbuild will now pick the minimum version between all duplicated target engines.

• Force .mp3 files to use the audio/mpeg MIME type (#​4485)

  MIME type detection for esbuild's data URLs uses Go's built-in MIME type detection, which is based on the MIME sniffing standard. This works correctly for MP3 files that start with the byte sequence ID3, which is commonly the case. However, it's possible to construct valid MP3 files that do not start with ID3, and that perhaps Go's built-in MIME type detection doesn't implement the "Signature for MP3 without ID3" part of the algorithm. This results in some .mp3 files incorrectly using the application/octet-stream MIME type instead of audio/mpeg. With this release, esbuild will now always use the audio/mpeg MIME type for files ending in .mp3.

• Add a new TypeScript syntax warning

  TypeScript 7 turned some previously-valid TypeScript syntax into a syntax error because it was confusing. TypeScript 6 accepts 1 + 2 as number * 3 as valid syntax but confusingly converts it to (1 + 2) * 3 instead of the more intuitive conversion to 1 + (2 * 3). This syntax is now an error in TypeScript 7+. With this release, esbuild will now warn about the use of this syntax:

  ▲ [WARNING] Operator "*" should not directly follow a TypeScript type cast after the "+" operator [confusing-typescript-cast]
  
      example.ts:1:28:
        1 │ console.log(1 + 2 as number * 3)
          ╵                             ^
  
    This is a syntax error in newer versions of TypeScript because the type cast has unintuitive
    precedence in this case. Surround the inner expression in parentheses to silence this warning:
  
      example.ts:1:12:
        1 │ console.log(1 + 2 as number * 3)
          │             ~~~~~~~~~~~~~~~
          ╵             (             )

  See microsoft/TypeScript#63527 for more information.

• Add support for formatting errors for Visual Studio (#​4460)

  Visual Studio has a specific style that it expects log messages to be in for them to show up in the UI when esbuild is run as a custom build step. The current log style that esbuild uses doesn't conform to this specific style.

  With this release, esbuild has a new log style for Visual Studio (and other tools in the MSBuild ecosystem) that can be enabled with --log-style=visualstudio. Here is an example log message in this style:

  $ esbuild example.ts --log-style=visualstudio
  /Users/evan/dev/esbuild/example.ts(1,29): warning ES0010: Operator "*" should not directly follow a TypeScript type cast after the "+" operator
  

  This log style is also available via the JS and Go APIs, and can now be used with the existing formatMessages API.

• Fix a bug with CSS gamut mapping (#​4488)

  Due to a typo, the fallback colors generated for CSS colors outside of the sRGB gamut weren't correct. This release fixes the generated colors to use the intended algorithm.

  This fix was submitted by @​chatman-media.

eslint/eslint (eslint)

v10.8.1

Compare Source

Bug Fixes

• 18eb0a7 fix: prevent ASI hazard in no-unused-labels autofix (#​21173) (dongkyu lee)
• 151ba3f fix: false positives in getter-return and accessor-pairs (#​21163) (Grit)
• 6898df9 fix: ignore meta-property names in id-denylist (#​21166) (Pixel)
• 4d7db66 fix: ignore meta-property names in id-match (#​21167) (Pixel)
• 677214e fix: handle ASI hazards in no-unused-vars removeVar suggestion (#​20935) (kuldeep kumar)

Documentation

• 7d0cbf8 docs: Update README (GitHub Actions Bot)
• 0a05812 docs: add missing backticks to no-duplicate-imports.js (#​21183) (Lee Daeun)
• 678c90b docs: Update README (GitHub Actions Bot)
• 8a10424 docs: Update README (GitHub Actions Bot)
• 69bb948 docs: Update README (GitHub Actions Bot)

Chores

• 0a14800 chore: update github/codeql-action action to v4.37.4 (#​21196) (renovate[bot])
• 05adcb1 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21191) (Lazizbek Ergashev)
• 5611035 test: add error locations info to no-void (#​21185) (Lee Daeun)
• ee47333 ci: bump github/codeql-action from 4 to 4.37.3 (#​21176) (dependabot[bot])
• f131c03 chore: improve ecosystem test failure reporting (#​20937) (crimsonjay0)
• 1f6edde chore: update ecosystem plugins (#​21182) (ESLint Bot)
• d3266fb chore: unpin webpack dependency (#​21172) (Francesco Trotta)
• 65a6519 chore: add allowScripts field to package.json (#​21092) (GiHoon Noh)
• 22e5256 ci: add triage:no label to Dependabot PRs (#​21141) (lumir)
• 55c9038 ci: bump actions/labeler from 6 to 7 (#​21159) (dependabot[bot])
• 7280e78 chore: update dependency prettier to v3.9.6 (#​21162) (renovate[bot])
• eddbad6 test: fix failing ecosystem test for eslint-plugin-unicorn (#​21156) (Francesco Trotta)
• 60a178d chore: update ecosystem plugins (#​21150) (ESLint Bot)
• f9f61dc test: add error locations to no-unreachable (#​21151) (JIYEON)
• d086293 test: add error locations to no-undef (#​21147) (JIYEON)
• cc01b67 test: add error locations to no-useless-catch (#​21144) (devoil)
• 688e75e chore: add missing backticks in JSDoc (#​21143) (Bo Hyun Kim)
• 7c1e175 test: add error locations to require-await (#​21145) (Grit)
• 588a26d test: add error locations to no-extra-label (#​21139) (dongkyu lee)
• 059aa89 test: add error locations to no-useless-concat (#​21140) (dongkyu lee)
• 5a452a8 test: add error locations to no-const-assign (#​21138) (dongkyu lee)

v10.8.0

Compare Source

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#​21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#​21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#​21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#​21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#​21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#​21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#​21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#​21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#​21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#​21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#​21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#​21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#​21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#​21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#​21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#​21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#​21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#​21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#​21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#​21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#​21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#​21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#​21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#​21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#​21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#​21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#​21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#​21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#​21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#​21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#​21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#​21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#​21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#​21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#​21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#​21079) (ESLint Bot)

azat-io/eslint-plugin-perfectionist (eslint-plugin-perfectionist)

v5.10.1

Compare Source

compare changes

🐞 Bug Fixes

• Fix crash in typescript 7
  (fbbc372)
• Fix complex comments cases not being auto-fixed correctly
  (7a35d8b)
• Respect ignored callback dependencies in nested calls
  (c9a119e)
• Take into account extended tsconfigs
  (93a267e)

❤️ Contributors

• Hugo (@​hugop95)

vuejs/eslint-plugin-vue (eslint-plugin-vue)

v10.10.0

Compare Source

markedjs/marked (marked)

v18.0.9

Compare Source

v18.0.8

Compare Source

Bug Fixes

• fall back to default checkbox renderer when extension returns false (#​4023) (e1b6139)

v18.0.7

Compare Source

ai/nanoid (nanoid)

v6.0.1

Compare Source

• Fixed docs.

oxc-project/oxc (oxfmt)

v0.63.0

Compare Source

v0.62.0

Compare Source

🐛 Bug Fixes

• e6e584b oxfmt: Type jsdoc. enum options (#​25008) (leaysgur)

v0.61.0

Compare Source

v0.60.0

Compare Source

v0.59.0

Compare Source

🐛 Bug Fixes

• 415fe1e oxfmt: Error on ignorePatterns that cannot match files outside the config directory (#​24286) (leaysgur)

sindresorhus/p-limit (p-limit)

v7.3.1

Compare Source

• Fix detached limit.map calls (#​108) ef37eb2

---

microsoft/playwright (playwright)

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

• New option [credentials](https://playwright.dev/docs/api/class-browsercontext#browser-context-

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone Asia/Shanghai)

• Branch creation
  • Only on Tuesday (* * * * 2)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
tempad-dev-site	Ready	Preview	Aug 22, 2026 6:06am