build(deps-dev): bump the development-dependencies group across 1 directory with 8 updates

[dependabot]

Bumps the development-dependencies group with 8 updates in the / directory:

Package	From	To
@eslint/compat	2.1.0	2.1.1
@playwright/test	1.62.1	1.63.0
eslint	10.8.1	10.10.0
globals	17.11.0	17.12.0
supabase	2.115.0	2.117.0
svelte	5.56.9	5.57.0
typescript-eslint	8.67.0	8.70.0
vite	8.2.1	8.3.0

Updates @eslint/compat from 2.1.0 to 2.1.1

Release notes

Sourced from @​eslint/compat's releases.

compat: v2.1.1

2.1.1 (2026-09-01)

Bug Fixes

• preserve markVariableAsUsed return value in compat context (#503) (66d9790)

Changelog

Sourced from @​eslint/compat's changelog.

2.1.1 (2026-09-01)

Bug Fixes

• preserve markVariableAsUsed return value in compat context (#503) (66d9790)

Commits

• a4466ca chore: release main (#504)
• 714ffde docs: Update README sponsors
• 66d9790 fix: preserve markVariableAsUsed return value in compat context (#503)
• caffae7 docs: Update README sponsors
• ae1ba25 docs: Update README sponsors
• 50051c6 docs: Update README sponsors
• ea83524 docs: Update README sponsors
• 29956ae docs: Update README sponsors
• f6d5bdf docs: Update README sponsors
• 8b71ed3 chore: restore eslint-plugin-jsdoc rules (#316)
• Additional commits viewable in compare view

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates eslint from 10.8.1 to 10.10.0

Release notes

Sourced from eslint's releases.

v10.10.0

Features

• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305) (Gihyeon Jeong / 정기현)
• c6cc6c5 feat: check Object.prototype property names in new-cap (#21269) (crimsonjay0)
• 5661fa6 feat: no-extra-bind false negatives with class fields and static blocks (#21260) (synthex-byte)

Bug Fixes

• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801) (Milos Djermanovic)
• 427ac0a fix: use format strings in debug calls (#21247) (Francesco Trotta)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261) (sethamus)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282) (김채영)
• 8e2cb14 fix: new-cap false positive for UTC calls with properties: false (#21275) (Pixel)
• 9f4a364 fix: Ignore static imports in no-unreachable (#21276) (Taha Kotil)

Documentation

• 2417cad docs: Update README (GitHub Actions Bot)
• 9cecb8a docs: document \c control letter escapes in no-control-regex (#21286) (한국)
• 8724829 docs: update compat table links (#21263) (fnx)
• 5634542 docs: Clarify eqeqeq suggestion behavior (#21256) (Müslüm Yılmaz)

Chores

• b3d876b chore: disable npm audit in ecosystem tests (#21306) (Francesco Trotta)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297) (Marry (Subin Yang))
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296) (renovate[bot])
• 3c753f1 chore: update eslint (#21289) (renovate[bot])
• 1c73469 chore: update ecosystem plugins (#21280) (ESLint Bot)
• 08a02be test: add error locations to no-extra-boolean-cast (#21266) (lumir)
• 77bb1db chore: update github/codeql-action action to v4.37.8 (#21270) (renovate[bot])
• 007e81a ci: skip EMFILE test on Node.js 26 (#21265) (lumir)
• 0430280 chore: improve ecosystem tests compatibility on Windows (#21178) (crimsonjay0)

v10.9.1

Bug Fixes

• 1e641c9 fix: no-loss-of-precision false positive with trailing decimal point (#21251) (Aleksandr Shoronov)

Documentation

• ad74a8d docs: add deprecation steps for EOL package versions (#21248) (Francesco Trotta)

Chores

• 3c3ae53 chore: update ecosystem plugins (#21249) (ESLint Bot)

v10.9.0

Features

• 08de88e feat: handle underflow in no-loss-of-precision (#21218) (Rithish S)
• 55db479 feat: add checkConditionalExpressions to no-unmodified-loop-condition (#21175) (sethamus)

Bug Fixes

• 2ba3025 fix: prevent unsafe no-var autofix with hoisted functions (#21213) (sethamus)
• 8e69622 fix: Prevent no-var autofix when var is shadowed by catch parameter (#21204) (Yang Hyeonjong)
• 684b579 fix: prefer-template invalid autofix creates a tagged template call (#21207) (김채영)

... (truncated)

Commits

• 3f20a57 10.10.0
• f4e5284 Build: changelog update for 10.10.0
• bb47dc6 fix: update dependency file-entry-cache to v11 (#20801)
• 427ac0a fix: use format strings in debug calls (#21247)
• b3d876b chore: disable npm audit in ecosystem tests (#21306)
• 9d81532 fix: support __proto__ in /* exported */ comments (#21261)
• 264b434 feat: add d and v flags to no-unexpected-multiline (#21305)
• 1696682 ci: restore EMFILE test on Node.js 26 (#21297)
• 2c7f5d6 chore: update github/codeql-action action to v4.37.9 (#21296)
• 87e0a08 fix: prefer-object-has-own autofix breaks when Object is shadowed (#21282)
• Additional commits viewable in compare view

Updates globals from 17.11.0 to 17.12.0

Release notes

Sourced from globals's releases.

v17.12.0

• Update globals (2026-09-01) (#353) 50a2119
• Add __webpack_layer__ global (#351) 779a11a

---

sindresorhus/globals@v17.11.0...v17.12.0

Commits

• 98008c3 17.12.0
• 50a2119 Update globals (2026-09-01) (#353)
• 779a11a Add __webpack_layer__ global (#351)
• See full diff in compare view

Updates supabase from 2.115.0 to 2.117.0

Release notes

Sourced from supabase's releases.

v2.117.0

Supabase CLI v2.117.0 — 2026-09-07

This release debuts experimental Workers commands for Edge Function management, introduces config management commands (diff and pull), and publishes the @​supabase/config package to npm for programmatic config access. The release also includes performance improvements, bug fixes across auth and database sync, and infrastructure updates.

Highlights

• Supabase Workers suite (experimental) — Manage Edge Functions from the CLI with new supabase experimental workers subcommands: new, list, status, delete, push (with --no-wait to skip build wait), and logs. Includes exposure control and instance configuration. (#6261, #6262, #6263, #6349, #6371, #6389, #6410, #6432)

• Config management suite — supabase config diff shows what would change before pushing; supabase config pull fetches your remote configuration locally. Config push now applies changes as diffs and confirms branch targets upfront. (#6295, #6438, #6446, #6454)

• @​supabase/config npm package — Programmatic access to config validation and diffing logic. (#6423, #6339, #6366, #6447)

New features

• Function slug in served functions — Function slugs are now available as environment variables. (#6345)

• Slim Docker images — Set SUPABASE_USE_SLIM_IMAGES=true to use smaller GHCR images locally. (#6382)

• Shadow baseline cache opt-out — Caching is now on by default; add --no-cache-baseline to disable. (#6403)

• Bundled pg-delta as standard — The bundled pg-delta engine is now the only implementation. (#6487)

Improvements

• SUPABASE_API_* environment variable overrides now work. (#6467)

• PowerShell users see a warning if the shell corrupts piped database dumps. (#6418)

• Parallel provisioning speeds up pg-delta schema diffs. (#6215)

• Unified output across workers commands. (#6389)

• ProjectConfig now covers hosted-field configuration. (#6451)

Bug fixes

• CLI accepts sbp_v0 tokens. (#6360)

• Auth email content_path restricted to project root. (#6489)

• Extension-managed database objects properly deleted in declarative sync. (#6449)

• Colliding schema names no longer skipped. (#6394)

• Provisioned ledger DDL statements now skipped. (#6422)

---

Plus multiple dependency updates and internal improvements.

... (truncated)

Commits

• 21db855 test(cli): cover config push and unlink (CLI-2293, CLI-2326) (#6494)
• 6689867 fix(cli): honor SUPABASE_API_* overrides (CLI-2318) (#6467)
• 3095e91 feat(cli): make the bundled pg-delta engine the only pg-delta implementation ...
• 8773536 refactor(config): consolidate command-family helpers (CLI-2292) (#6491)
• ad95a9a fix(cli): confine auth email content_path to project root (CLI-2320) (#6489)
• 3343c2f fix(cli): hedge config's 404 message, align push load errors (#6490)
• 5ba4bc8 chore: restructured cli directory - flatten src/legacy/* into src/ (#6486)
• 25ffc73 fix(cli): honour deletion of extension-managed objects in declarative sync (#...
• 2c66579 feat(workers): add exposure control and new --instances flag (#6432)
• adc1dfa test(cli): narrow config pull live pin (CLI-2324) (#6468)
• Additional commits viewable in compare view

Updates svelte from 5.56.9 to 5.57.0

Release notes

Sourced from svelte's releases.

svelte@5.57.0

Minor Changes

• feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server (#18648)

• feat: add has function to createContext (#18472)

• feat: support defaultValue on <select> (#18591)

• feat: add getOrInsert/getOrInsertComputed to SvelteMap (#18728)

Patch Changes

• fix: block template store subscriptions on the promise that assigns the store (#18582)

• fix: route $derived teardown errors through invoke_error_boundary (#18486)

• fix: track SvelteDate snapshots in reactions (#18700)

• fix: remove <svelte:head> anchors on unmount (#18697)

• fix: warn on undeclared shorthand event handlers on <svelte:window>, <svelte:document> and <svelte:body> (#18480)

• perf: reuse the cached value in the <option>/<select> value guard (#18713)

• fix: prevent malformed AST output for <select> with static value attribute (#18449)

• fix: apply ownership mutation ignores to binding assignments (#18718)

• fix: prevent onoutroend from firing twice when compilerOptions.hmr is true (#18655)

• fix: preserve whitespace after inline elements when printing (#18685)

• perf: fold SSR block-open markers into the branch's first push (#18712)

• fix: run onDestroy callbacks when a server render throws (#18585)

• fix: report derived_invalid_export for export let x = $derived(...) in runes mode (#18692)

• fix: never apply class hash to elements inside <svelte:head> (#18160)

• fix: keep defaultChecked on hydrated radio inputs with spread attributes (#18701)

• fix: accept onfocusin/onfocusout in a11y_mouse_events_have_key_events (#18689)

• perf: O(n²)→O(n) Map lookups for legacy $: reactive statement ordering (#18602)

• fix: distinct memoizer on style/class directives (#18466)

• fix: measure nested transitions before applying their starting styles (#18647)

... (truncated)

Changelog

Sourced from svelte's changelog.

5.57.0

Minor Changes

• feat: export RenderOutput, SyncRenderOutput, Csp and Sha256Source from svelte/server (#18648)

• feat: add has function to createContext (#18472)

• feat: support defaultValue on <select> (#18591)

• feat: add getOrInsert/getOrInsertComputed to SvelteMap (#18728)

Patch Changes

• fix: block template store subscriptions on the promise that assigns the store (#18582)

• fix: route $derived teardown errors through invoke_error_boundary (#18486)

• fix: track SvelteDate snapshots in reactions (#18700)

• fix: remove <svelte:head> anchors on unmount (#18697)

• fix: warn on undeclared shorthand event handlers on <svelte:window>, <svelte:document> and <svelte:body> (#18480)

• perf: reuse the cached value in the <option>/<select> value guard (#18713)

• fix: prevent malformed AST output for <select> with static value attribute (#18449)

• fix: apply ownership mutation ignores to binding assignments (#18718)

• fix: prevent onoutroend from firing twice when compilerOptions.hmr is true (#18655)

• fix: preserve whitespace after inline elements when printing (#18685)

• perf: fold SSR block-open markers into the branch's first push (#18712)

• fix: run onDestroy callbacks when a server render throws (#18585)

• fix: report derived_invalid_export for export let x = $derived(...) in runes mode (#18692)

• fix: never apply class hash to elements inside <svelte:head> (#18160)

• fix: keep defaultChecked on hydrated radio inputs with spread attributes (#18701)

• fix: accept onfocusin/onfocusout in a11y_mouse_events_have_key_events (#18689)

• perf: O(n²)→O(n) Map lookups for legacy $: reactive statement ordering (#18602)

• fix: distinct memoizer on style/class directives (#18466)

... (truncated)

Commits

• 7bc0a70 Version Packages (#18682)
• 6374a2a chore: move @types/trusted-types to devDependencies (#18730)
• 4ae5eb3 feat: add has function to createContext (#18472)
• 5034b59 chore: bump playwright (#18729)
• 74197cc feat: add getOrInsert/getOrInsertComputed to SvelteMap (#18728)
• edbe11e fix: properly apply static textarea value attribute during CSR (#18727)
• 05b6916 fix: omit bind:focused from SSR output (#18724)
• 7c6f36a fix: keep boolean attributes with an empty string value when rendering attrib...
• 2e8b57b fix: render selected options for \<select multiple> with an array value ...
• 864de81 fix: keep the current selection of a \<select> when its defaultValue is ap...
• Additional commits viewable in compare view

Updates typescript-eslint from 8.67.0 to 8.70.0

Release notes

Sourced from typescript-eslint's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

v8.69.0

8.69.0 (2026-08-31)

🚀 Features

• eslint-plugin: [no-misused-promises] add flagUnions option for checkConditionals (#12603)

🩹 Fixes

• eslint-plugin: [no-mixed-enums] use scope analysis instead of type checking for merged namespaces (#12731)
• eslint-plugin: [unified-signatures] compare type parameters by constraint instead of name (#12741)
• eslint-plugin: [no-meaningless-void-operator] report void on non-call expressions (#12727)
• website: respect allowJs playground config (#12744)

❤️ Thank You

• Abdu Alim Arlikhozhaev @​Arlikhozhaev
• Evyatar Daud @​StyleShit

... (truncated)

Changelog

Sourced from typescript-eslint's changelog.

8.70.0 (2026-09-07)

🩹 Fixes

• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)

❤️ Thank You

• Ulrich Stark @​ulrichstark

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.69.0 (2026-08-31)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

8.68.0 (2026-08-24)

This was a version bump only for typescript-eslint to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• 4586535 fix(eslint-plugin): [no-deprecated] report deprecated imported values used in...
• 9a6e546 chore(release): publish 8.69.0
• 8f4e00a chore(release): publish 8.68.0
• 55f6d5d chore: enable source maps (#12677)
• See full diff in compare view

Updates vite from 8.2.1 to 8.3.0

Release notes

Sourced from vite's releases.

create-vite@8.3.0

Please refer to CHANGELOG.md for details.

v8.3.0

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)

Performance Improvements

• proxy: pre-compile context matchers at server creation (#23263) (8abf700)

v8.3.0-beta.1

Features

• devtools: enable dev server integration (#23333) (68aeb8a)

Bug Fixes

• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)

Miscellaneous Chores

• introducing @e18e/eslint-plugin (#23357) (f794133)
• remove unnecessary comment (#23448) (b919a1a)

v8.3.0-beta.0

Features

• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)

... (truncated)

Changelog

Sourced from vite's changelog.

8.3.0 (2026-09-10)

Features

• build: avoid settling seen preload dependencies for performance (#23446) (e6f6b3e)
• devtools: enable dev server integration (#23333) (68aeb8a)
• accept Rolldown watch options in server.watch (#23133) (1b5cfe3)
• add closeServer and closePreviewServer hooks (#23110) (e17d2d5)
• add top-level tsconfig option (#23310) (93164c3)
• add warning for unsupported hooks in plugin returned from applyToEnvironment hook (#23191) (fdef04f)
• cli: support naming the CPU profile via --profile [name] (#23042) (a500dee)
• config: warn on named imports from JSON modules (#23378) (472385e)
• css: minify style tag (#23183) (8156684)
• searched params attached to workers are now preserved (#22280) (517b97f)
• support subpath imports in dynamic import statements (#23185) (b78e2f1)
• use import.meta.ROLLDOWN_FILE_URL_* for assets in JS (#22888) (4366ac4)
• use import.meta.ROLLDOWN_FILE_URL_* for other plugins (#22894) (e38f29e)
• worker: remove worker chunk if it's detected that it's not referenced (#22473) (924997a)

Bug Fixes

• handle CRLF line endings in code frame positions (#23219) (9913672)
• only treat whole node_modules path segments as dependencies (fix #17467) (#23437) (ef0dc17)
• build: keep hash placeholders as-is in resolveFileUrl hook (#23422) (e8d6a4d)
• bundled-dev: mark payload delivered on client report (#23373) (a6d43bc)
• deps: update all non-major dependencies (#23445) (fc7c104)
• html: don't inline preload link targets (fix #13355) (#23387) (12e709c)
• resolve the actual package root in findNearestMainPackageData for nested package.json (#23356) (8492422)
• shortcuts extend error (#23447) (4ec58d1)
• config: close bundles when generation fails (#23256) (6bacc95)
• css: keep newline-separated srcset candidates intact (#23265) (4f9d2f4)
• deps: update all non-major dependencies (#23337) (d550815)
• deps: update all non-major dependencies (#23404) (238ad81)
• deps: update rolldown-related dependencies (#23338) (76e8082)
• deps: update rolldown-related dependencies (#23405) (b882566)
• dev: run closeBundle after buildEnd failure (#23165) (8cb872e)
• hmr: handle import.meta.hot.invalidate in virtual module (#23171) (6162968)
• utils: handle dot in srcset density descriptor (#23346) (b50e1b4)
• utils: match timestamp query parameter with proper delimiters (

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
gitgud	Ready	Preview	Sep 14, 2026 6:19am UTC

[dependabot]

Looks like these dependencies are updatable in another way, so this is no longer needed.