Skip to content

chore(deps): bump the minor-and-patch group with 7 updates#123

Open
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-a0a9a34276
Open

chore(deps): bump the minor-and-patch group with 7 updates#123
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/npm_and_yarn/minor-and-patch-a0a9a34276

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 27, 2026

Bumps the minor-and-patch group with 7 updates:

Package From To
@astrojs/sitemap 3.7.2 3.7.3
astro 6.3.7 6.3.8
dompurify 3.4.5 3.4.7
@astrojs/check 0.9.2 0.9.9
@biomejs/biome 2.4.15 2.4.16
lighthouse 13.1.0 13.3.0
playwright 1.59.1 1.60.0

Updates @astrojs/sitemap from 3.7.2 to 3.7.3

Release notes

Sourced from @​astrojs/sitemap's releases.

@​astrojs/sitemap@​3.7.3

Patch Changes

  • #16837 783c4a6 Thanks @​jdevalk! - Improves <lastmod> accuracy in the sitemap index. Each <sitemap> entry in sitemap-index.xml is now stamped with the most recent lastmod of the URLs in the child sitemap it points to, instead of repeating a single global date on every entry. When a child sitemap has no per-URL lastmod, the entry falls back to the lastmod option as before. This gives search engines a per-file freshness signal, so they can tell which child sitemaps actually changed without refetching all of them.
Changelog

Sourced from @​astrojs/sitemap's changelog.

3.7.3

Patch Changes

  • #16837 783c4a6 Thanks @​jdevalk! - Improves <lastmod> accuracy in the sitemap index. Each <sitemap> entry in sitemap-index.xml is now stamped with the most recent lastmod of the URLs in the child sitemap it points to, instead of repeating a single global date on every entry. When a child sitemap has no per-URL lastmod, the entry falls back to the lastmod option as before. This gives search engines a per-file freshness signal, so they can tell which child sitemaps actually changed without refetching all of them.
Commits

Updates astro from 6.3.7 to 6.3.8

Release notes

Sourced from astro's releases.

astro@6.3.8

Patch Changes

  • #16830 f2bf3cb Thanks @​matthewp! - Fixes 404s for dynamically imported JS chunks when using an adapter with assetQueryParams (e.g. Vercel skew protection)

  • #16831 ace96ba Thanks @​astrobot-houston! - Fixes a misleading GetStaticPathsRequired error when a redirect is configured from a dynamic route to a static (or less-dynamic) destination. For example, '/project/[slug]': '/' previously produced a confusing error pointing at index.astro. Astro now detects the parameter mismatch at config validation time and throws a clear InvalidRedirectDestination error naming the missing parameters.

  • #16702 b7d1758 Thanks @​matthewp! - Fixes scoped styles from .astro components being dropped when rendered inside MDX content (<Content /> from render(entry)) passed through a named slot using <Fragment slot="X">. The Fragment component now eagerly evaluates its slot contents to ensure propagating components register their styles before head content is flushed.

  • #16823 3df6a45 Thanks @​astrobot-houston! - Fixes missing CSS for conditionally rendered Svelte components in production builds

  • #16836 3d7adfa Thanks @​LongYC! - Document compressHTML: "jsx" config is only available since Astro v6.2.0

  • #16864 334ce13 Thanks @​cheets! - Fixes a false-positive Internal Warning: route cache overwritten logged on every SSR request for dynamic routes

Changelog

Sourced from astro's changelog.

6.3.8

Patch Changes

  • #16830 f2bf3cb Thanks @​matthewp! - Fixes 404s for dynamically imported JS chunks when using an adapter with assetQueryParams (e.g. Vercel skew protection)

  • #16831 ace96ba Thanks @​astrobot-houston! - Fixes a misleading GetStaticPathsRequired error when a redirect is configured from a dynamic route to a static (or less-dynamic) destination. For example, '/project/[slug]': '/' previously produced a confusing error pointing at index.astro. Astro now detects the parameter mismatch at config validation time and throws a clear InvalidRedirectDestination error naming the missing parameters.

  • #16702 b7d1758 Thanks @​matthewp! - Fixes scoped styles from .astro components being dropped when rendered inside MDX content (<Content /> from render(entry)) passed through a named slot using <Fragment slot="X">. The Fragment component now eagerly evaluates its slot contents to ensure propagating components register their styles before head content is flushed.

  • #16823 3df6a45 Thanks @​astrobot-houston! - Fixes missing CSS for conditionally rendered Svelte components in production builds

  • #16836 3d7adfa Thanks @​LongYC! - Document compressHTML: "jsx" config is only available since Astro v6.2.0

  • #16864 334ce13 Thanks @​cheets! - Fixes a false-positive Internal Warning: route cache overwritten logged on every SSR request for dynamic routes

Commits

Updates dompurify from 3.4.5 to 3.4.7

Release notes

Sourced from dompurify's releases.

DOMPurify 3.4.7

  • Hardened the handling of Shadow Roots when using IN_PLACE, thanks @​GameZoneHacker
  • Removed a problem leading to permanent hook pollution, thanks @​offset
  • Refactored the test suite and expanded test coverage significantly

DOMPurify 3.4.6

  • Fixed several issues with DOM Clobbering in IN_PLACE mode, thanks @​offset & @​Bankde
  • Hardened the checks for cross-realm IN_PLACE and Shadow DOM sanitization, thanks @​offset & @​Bankde
  • Added more test coverage for IN_PLACE and general DOM Clobbering attacks
  • Bumped several dependencies where possible
Commits

Updates @astrojs/check from 0.9.2 to 0.9.9

Release notes

Sourced from @​astrojs/check's releases.

@​astrojs/check@​0.9.9

Patch Changes

Changelog

Sourced from @​astrojs/check's changelog.

0.9.9

Patch Changes

0.9.8

Patch Changes

0.9.7

Patch Changes

0.9.7-beta.1

Patch Changes

0.9.6-beta.1

Patch Changes

0.9.6-alpha.0

Patch Changes

  • Updated dependencies [df6d2d7]:
    • @​astrojs/language-server@​2.16.1-alpha.0

... (truncated)

Commits
Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​astrojs/check since your current version.


Updates @biomejs/biome from 2.4.15 to 2.4.16

Release notes

Sourced from @​biomejs/biome's releases.

Biome CLI v2.4.16

2.4.16

Patch Changes

  • #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

  • #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

    Input:

    <span
  ><!-- 1
--><span>a</span
  ><!-- 2
--><span>b</span
  ><!-- 3
--></span>

    Output:

      <span
	  ><!-- 1
- --> <span>a</span<!-- 2
- --> ><span>b</span><!-- 3
+ --><span>a</span><!-- 2
+ --><span>b</span><!-- 3
  --></span
  >

  • #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

  • #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

  • #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

  • #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

  • #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

  • #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

  • #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

  • #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

... (truncated)

Changelog

Sourced from @​biomejs/biome's changelog.

2.4.16

Patch Changes

  • #10329 ef764d5 Thanks @​Conaclos! - Fixed an issue where diagnostics showed an incorrect location in Astro files.

  • #10363 50aa415 Thanks @​dyc3! - Fixed HTML formatting for a case where comments could cause the formatter to split up a closing tag, which would cause the resulting HTML to be syntactically invalid.

    Input:

    <span
  ><!-- 1
--><span>a</span
  ><!-- 2
--><span>b</span
  ><!-- 3
--></span>

    Output:

      <span
	  ><!-- 1
- --> <span>a</span<!-- 2
- --> ><span>b</span><!-- 3
+ --><span>a</span><!-- 2
+ --><span>b</span><!-- 3
  --></span
  >

  • #10465 0c718da Thanks @​dfedoryshchev! - Fixed diagnostics emitted by the noUntrustedLicenses rule.

  • #10358 05c2617 Thanks @​dyc3! - Fixed #10356: biome rage --linter now displays rules enabled through linter domains in the enabled rules list.

  • #10300 950247c Thanks @​dyc3! - Fixed #10265: Svelte function bindings such as bind:value={get, set} are now parsed more precisely, so noCommaOperator won't emit false positives for that syntax anymore.

  • #9786 e71f584 Thanks @​MeGaNeKoS! - Fixed #8480: useDestructuring now provides variableDeclarator and assignmentExpression options to control which contexts enforce destructuring, matching ESLint's prefer-destructuring configuration. Both default to {array: true, object: true}. The diagnostic for object destructuring in assignment expressions now instructs users to wrap the assignment in parentheses.

  • #10425 1948b72 Thanks @​sjh9714! - Fixed #10244: The useOptionalChain rule now detects negated guard inequality chains like !foo || foo.bar !== "x".

  • #10442 001f94f Thanks @​ematipico! - Fixed #10411: noMisusedPromises no longer causes a stack overflow when a nested function returns an object with shorthand properties that shadow destructured variables from an outer scope.

  • #10318 9b1577f Thanks @​dyc3! - Added support for formatter.trailingCommas in overrides. This option was previously available in the top-level formatter configuration but missing from formatter overrides.

  • #10319 2e37709 Thanks @​dyc3! - Fixed Vue and Svelte formatting for standalone interpolations in inline elements. Biome now preserves existing newlines in cases like:

    

    • 






... (truncated)





Commits

    

  • 5f4ea56 ci: release (#10326)
    • 

  • de2a33c fix(core): regression in emitted types (#10478)
    • 

  • d835303 docs: remove redundant default phrase in useConsistentObjectDefinitions rul...
    • 

  • 4f1aaf2 fix: incorrect build when using build or test (#10426)
    • 

  • dc73b6b refactor: make plugins opt-in via feature gate (#10418)
    • 

  • e71f584 feat(useDestructuring): add options for assignment/declaration and improve di...
    • 

  • 9b1577f fix(config): support trailingCommas in overrides (#10318)
    • 

  • See full diff in compare view
    • 







Updates lighthouse from 13.1.0 to 13.3.0



Release notes

Sourced from lighthouse's releases.




v13.3.0


Full Changelog


We expect this release to ship in the DevTools of Chrome 150, and to PageSpeed Insights within 2 weeks.


Notable Changes


    

  • New agentic browsing category added to default config (#17002)
    • 



Core


    

  • agentic-web: add links to category and audit descriptions (#16997)
    • 

  • llms-txt: adjust titles and descriptions and add smoketests (#17005)
    • 



Deps


    

  • upgrade dependencies (#17006)
    • 



Tests


    

  • smoke: widen byte efficiency wastedBytes range for ToT (#16996)
    • 

  • webmcp: add webmcp smoketests (#16999)
    • 



Misc


    

  • bundle: update build-bundle-mcp (#16995)
    • 



v13.2.0


Full Changelog


We expect this release to ship in the DevTools of Chrome 150, and to PageSpeed Insights within 2 weeks.


New contributors


Thanks to our new contributors 👽🐷🐰🐯🐻!



New Audits


    

  • webmcp-form-coverage: add audit for missing webmcp tool annotations (#16964)
    • 

  • webmcp-registered-tools: add audit to list registered webmcp tools (#16959)
    • 

  • webmcp-schema-validity: add audit to check WebMCP schema issues (#16973)
    • 



Core


    

  • implement UKM Invalidate fallback for LCP (#16956)
    • 

  • agentic: add new agentic browsing category (#16953)
    • 






... (truncated)





Changelog

Sourced from lighthouse's changelog.




13.3.0 (2026-05-07)


Full Changelog


We expect this release to ship in the DevTools of Chrome 150, and to PageSpeed Insights within 2 weeks.


Notable Changes


    

  • New agentic browsing category added to default config (#17002)
    • 



Core


    

  • agentic-web: add links to category and audit descriptions (#16997)
    • 

  • llms-txt: adjust titles and descriptions and add smoketests (#17005)
    • 



Deps


    

  • upgrade dependencies (#17006)
    • 



Tests


    

  • smoke: widen byte efficiency wastedBytes range for ToT (#16996)
    • 

  • webmcp: add webmcp smoketests (#16999)
    • 



Misc


    

  • bundle: update build-bundle-mcp (#16995)
    • 





13.2.0 (2026-04-30)


Full Changelog


We expect this release to ship in the DevTools of Chrome 150, and to PageSpeed Insights within 2 weeks.


New contributors


Thanks to our new contributors 👽🐷🐰🐯🐻!



New Audits


    

  • webmcp-form-coverage: add audit for missing webmcp tool annotations (#16964)
    • 

  • webmcp-registered-tools: add audit to list registered webmcp tools (#16959)
    • 

  • webmcp-schema-validity: add audit to check WebMCP schema issues (#16973)
    • 



Core


    

  • implement UKM Invalidate fallback for LCP (#16956)
    • 

  • agentic: add new agentic browsing category (#16953)
    • 






... (truncated)





Commits

    

  • 7d8dcf5 v13.3.0 (#17008)
    • 

  • f146050 deps: upgrade dependencies (#17006)
    • 

  • ec66b4a core(llms-txt): adjust titles and descriptions and add smoketests (#17005)
    • 

  • 147d04c tests(webmcp): add webmcp smoketests (#16999)
    • 

  • e120fad Revert "clients(devtools): include agentic browsing config in devtools entry"...
    • 

  • e796f1b core(agentic browsing): add agentic browsing category to default config (#17002)
    • 

  • e148cc6 Revert "clients(devtools): include agentic browsing config in devtools entry"...
    • 

  • 081b1f2 clients(devtools): include agentic browsing config in devtools entry (#16998)
    • 

  • 7db9ab8 core(agentic-web): add links to category and audit descriptions (#16997)
    • 

  • 8c6a64e misc(bundle): update build-bundle-mcp (#16995)
    • 

  • Additional commits viewable in compare view
    • 







Updates playwright from 1.59.1 to 1.60.0



Release notes

Sourced from playwright's releases.




v1.60.0


🌐 HAR recording on Tracing


tracing.startHar() / tracing.stopHar() expose HAR recording as a first-class tracing API, with the same content, mode and urlFilter options as recordHar. The returned Disposable makes it easy to scope a recording with await using:


await using har = await context.tracing.startHar('trace.har');
const page = await context.newPage();
await page.goto('https://playwright.dev');
// HAR is finalized when `har` goes out of scope.


🪝 Drop API


New locator.drop() simulates an external drag-and-drop of files or clipboard-like data onto an element. Playwright dispatches dragenter, dragover, and drop with a synthetic [DataTransfer] in the page context — works cross-browser and is great for testing upload zones:


await page.locator('#dropzone').drop({
  files: { name: 'note.txt', mimeType: 'text/plain', buffer: Buffer.from('hello') },
});
await page.locator('#dropzone').drop({
data: {
'text/plain': 'hello world',
'text/uri-list': 'https://example.com',
},
});


🎯 Aria snapshots



🛑 test.abort()


New test.abort() aborts the currently running test from a fixture, hook, or route handler with an optional message. Use it when you have detected an unrecoverable misuse and want to fail the test right away:


test('does not publish to the shared page', async ({ page }) => {
  await page.route('**/publish', route => {
    test.abort('Tests must not publish to the shared page. Use the `clone` option.');
    return route.abort();
  });
  // ...
});


New APIs


Browser, Context and Page





... (truncated)





Commits






Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.





Dependabot commands and options



You can trigger Dependabot actions by commenting on this PR:


    

  • @dependabot rebase will rebase this PR
    • 

  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
    • 

  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
    • 

  • @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
    • 

  • @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
    • 

  • @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
    • 

  • @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
    • 




    

  
  



      


          

          
  
  

    
  
    
    

  

  

  



                    

          
        





  





    



      

  
        

  

      

  
  

  
          

  

    

      


  

      
        @dependabot
  




      

        
          chore(deps): bump the minor-and-patch group with 7 updates
        

          
                        
      


      

        

    
    
    

  

    


      


      

        

          

    
    
    

  

  

    
  



        

      


      

        
          7bda62c
        
      

    

  

    

      
Bumps the minor-and-patch group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [@astrojs/sitemap](https://github.com/withastro/astro/tree/HEAD/packages/integrations/sitemap) | `3.7.2` | `3.7.3` |
| [astro](https://github.com/withastro/astro/tree/HEAD/packages/astro) | `6.3.7` | `6.3.8` |
| [dompurify](https://github.com/cure53/DOMPurify) | `3.4.5` | `3.4.7` |
| [@astrojs/check](https://github.com/withastro/astro/tree/HEAD/packages/language-tools/astro-check) | `0.9.2` | `0.9.9` |
| [@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome) | `2.4.15` | `2.4.16` |
| [lighthouse](https://github.com/GoogleChrome/lighthouse) | `13.1.0` | `13.3.0` |
| [playwright](https://github.com/microsoft/playwright) | `1.59.1` | `1.60.0` |


Updates `@astrojs/sitemap` from 3.7.2 to 3.7.3
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/integrations/sitemap/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/sitemap@3.7.3/packages/integrations/sitemap)

Updates `astro` from 6.3.7 to 6.3.8
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/astro/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/astro@6.3.8/packages/astro)

Updates `dompurify` from 3.4.5 to 3.4.7
- [Release notes](https://github.com/cure53/DOMPurify/releases)
- [Commits](cure53/DOMPurify@3.4.5...3.4.7)

Updates `@astrojs/check` from 0.9.2 to 0.9.9
- [Release notes](https://github.com/withastro/astro/releases)
- [Changelog](https://github.com/withastro/astro/blob/main/packages/language-tools/astro-check/CHANGELOG.md)
- [Commits](https://github.com/withastro/astro/commits/@astrojs/check@0.9.9/packages/language-tools/astro-check)

Updates `@biomejs/biome` from 2.4.15 to 2.4.16
- [Release notes](https://github.com/biomejs/biome/releases)
- [Changelog](https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md)
- [Commits](https://github.com/biomejs/biome/commits/@biomejs/biome@2.4.16/packages/@biomejs/biome)

Updates `lighthouse` from 13.1.0 to 13.3.0
- [Release notes](https://github.com/GoogleChrome/lighthouse/releases)
- [Changelog](https://github.com/GoogleChrome/lighthouse/blob/main/changelog.md)
- [Commits](GoogleChrome/lighthouse@v13.1.0...v13.3.0)

Updates `playwright` from 1.59.1 to 1.60.0
- [Release notes](https://github.com/microsoft/playwright/releases)
- [Commits](microsoft/playwright@v1.59.1...v1.60.0)

---
updated-dependencies:
- dependency-name: "@astrojs/sitemap"
  dependency-version: 3.7.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: astro
  dependency-version: 6.3.8
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: dompurify
  dependency-version: 3.4.7
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@astrojs/check"
  dependency-version: 0.9.9
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: "@biomejs/biome"
  dependency-version: 2.4.16
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: minor-and-patch
- dependency-name: lighthouse
  dependency-version: 13.3.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
- dependency-name: playwright
  dependency-version: 1.60.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: minor-and-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

    







  








      

  
            

    

      
    

    


      


          @dependabot
dependabot
Bot



          added
  the 

  dependencies

  Pull requests that update a dependency file
 label


      May 27, 2026

    

  



  

  
  

  
      @dependabot
  dependabot
Bot

          requested a review
  from 4444J99
    as a code owner


    May 27, 2026 16:38    
    













  
  

    

      

  










  








  
      

  
    Sign up for free
    to join this conversation on GitHub.
    Already have an account?
    Sign in to comment


  










      

  

    
    

    

  

    Reviewers
  


    


      

          


  
      @4444J99
  
    4444J99


                Awaiting requested review from 4444J99

                    4444J99 is a code owner

        
      



      






    

  


      
  

    Assignees
  



        


    No one assigned







      


  


  

    Labels
  



    

      

    dependencies

  Pull requests that update a dependency file








      

  

    

        

    Projects
  


        




    None yet




  



      


  

    
  

    Milestone
  


      No milestone





    
      
          


  

    

      
        

          
  

    Development
  



            


Successfully merging this pull request may close these issues.





  
  



      
    

  




      

    

  
        

  

    

      0 participants