deps: bump the minor-and-patch group across 1 directory with 7 updates

[dependabot]

Bumps the minor-and-patch group with 7 updates in the / directory:

Package	From	To
@radix-ui/react-slot	1.1.2	1.3.3
@testing-library/dom	10.4.0	10.4.1
@testing-library/react	16.2.0	16.3.3
canvas-confetti	1.9.3	1.9.4
postcss	8.5.3	8.5.28
tailwind-merge	3.0.2	3.6.0
@playwright/test	1.62.0	1.63.0

Updates @radix-ui/react-slot from 1.1.2 to 1.3.3

Changelog

Sourced from @​radix-ui/react-slot's changelog.

1.3.2, 1.3.3

• Reverted breaking changes that caused compatibility issues with React Server Components.

1.3.1

• Republish through CI to attach provenance attestations. The previous versions of these packages were published manually outside of CI and therefore shipped without provenance; this patch re-releases the same code through the CI pipeline so every package includes an attestation.
• Updated dependencies: @radix-ui/primitive@1.1.7, @radix-ui/react-compose-refs@1.1.4

1.3.0

Added generic type arguments for SlotProps and createSlot

SlotProps and createSlot now accept generic type arguments to specify the type of element a slot should render, as well as its props.

const Slot = createSlot<HTMLButtonElement, MyCustomButtonProps>('Slot');

1.2.5

• Fixed infinite re-render loop in React 19 caused by Slot creating a new ref callback on every render
• Added support for nested Slottable via a render prop, so a slotted element can be wrapped while still merging Slot props and refs onto it
• Added repository.directory to all package.json files
• Improved error messages for invalid slot children
• Updated dependencies: @radix-ui/react-compose-refs@1.1.3

1.2.4

• Fixed an issue with how slot components interact with lazy React components. In the case of a lazy component instance, the resulting promise must be consumed to render the desired component.

1.2.3

• Replace deprecated 'ElementRef' with 'ComponentRef' (#3426)
• Revert slot changes causing errors in server components

1.2.2

• Add use client to slot entry to prevent RSC errors

1.2.1

• Use stable composed refs in SlotClone (#3477)

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​radix-ui/react-slot since your current version.

Updates @testing-library/dom from 10.4.0 to 10.4.1

Release notes

Sourced from @​testing-library/dom's releases.

v10.4.1

10.4.1 (2025-07-27)

Bug Fixes

• deps: replace chalk with picocolors (#1341) (225a3e4)

Commits

• 225a3e4 fix(deps): replace chalk with picocolors (#1341)
• See full diff in compare view

Updates @testing-library/react from 16.2.0 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

• Update 'onCaughtError' type inference in 'RenderOptions' to work with React v19 (#1438) (f32bd1b)

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

• Switch to trusted publishing (#1437) (a2d37ff)

v16.3.0

16.3.0 (2025-04-02)

Features

• add bernardobelchior as a contributor for code, and doc (#1391) (9fc6a75)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (#1468)
• be9d81d docs: fix typos in comments and types (#1446)
• f32bd1b fix: Update 'onCaughtError' type inference in 'RenderOptions' to work with Re...
• a2d37ff fix: Switch to trusted publishing (#1437)
• cd6a175 chore: fix action permissions (#1436)
• 22b8c28 chore: fix release (#1435)
• d996673 chore: new release workflow (#1434)
• 205ce17 chore: fix typo in jest.config.js (#1427)
• aba5740 [test] Fix tests for react@experimental (#1424)
• 590bc18 [test] Fix npm run typecheck (#1423)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for @​testing-library/react since your current version.

Updates canvas-confetti from 1.9.3 to 1.9.4

Release notes

Sourced from canvas-confetti's releases.

1.9.4

What's Changed

• Fix error in canDrawBitmap if OffscreenCanvas exists but is not supported by @​Gavin-Hofer in catdad/canvas-confetti#258

Maintenance

• updating github actions to the latest versions by @​catdad in catdad/canvas-confetti#259

New Contributors

• @​Gavin-Hofer made their first contribution in catdad/canvas-confetti#258

Full Changelog: catdad/canvas-confetti@1.9.3...1.9.4

Commits

• 5f77cde bumping version to 1.9.4
• f0027c6 updating to use github action as trusted publisher
• 0566ad2 Merge pull request #258 from Gavin-Hofer/gavin/fix-offscreen-canvas-error
• 51e7932 Merge branch 'master' into gavin/fix-offscreen-canvas-error
• c4385c8 Merge pull request #259 from catdad/actions-update
• 4bf60a5 updating linting to later versions that work in node 24
• 0d755bc using latest version of node
• 664a8bb updating actions to the latest versions
• c1748fe Fixed error in canDrawBitmap if OffscreenCanvas exists but is not supported
• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for canvas-confetti since your current version.

Updates postcss from 8.5.3 to 8.5.28

Release notes

Sourced from postcss's releases.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

8.5.18

• Restricted loading previous source maps file to the opts.from folder for security reasons (use unsafeMap: true to disable the check).

8.5.17

• Fixed Maximum call stack size exceeded error.
• Fixed Prototype hijacking for postcss.fromJSON().
• Fixed Input#origin() for unmapped end position (by @​chatman-media).

8.5.16

• Fixed Input#origin() position (by @​mizdra).

... (truncated)

Changelog

Sourced from postcss's changelog.

8.5.28

• Fixes types regression.

8.5.27

• Fixed removing any comments starting with /*# (by @​dylanpulver).
• Fixed * hack before a comment in Custom Properties (by @​Jaybhade).
• Fixed empty values in the middle of list.comma() (by @​MahinAnowar).
• Fixed whitespace-only values in list.space() (by @​MahinAnowar).
• Fixed rule’s end position on space before semicolon (by @​maximilliangrand).
• Fixed types (by @​romainmenke).
• Fixed Chinese text in deprecation warning (by @​Jesse205).

8.5.26

• Fixed list.split() regression (by @​lazerg).
• Track symlinks in path protection in source map loading (by @​drengir1).

8.5.25

• Fixed 8.5.17 visitor regression.
• Fixed list.split() for non-string values (by @​amir-rezaei).

8.5.24

• Preserve the BOM after the processing (by @​hdimer).

8.5.23

• Do not load source map without opts.from for security reasons.

8.5.22

• Fixed custom property losing semicolon before a comment (by @​sarathfrancis90).

8.5.21

• Fixed childless at-rule losing semicolon before comment (by @​sarathfrancis90).
• Fixed docs (by @​isker).

8.5.20

• Fixed missing space if AtRule#params is set after (by @​sarathfrancis90).
• Fixed mixing AST error on warnings (by @​MahinAnowar).

8.5.19

• Fixed cleaning before for new nodes inserted to Root (by @​MahinAnowar).

... (truncated)

Commits

• e544bff Release 8.5.28 version
• f8fc252 Typo
• 5039fd7 Add missed release notes
• ae40ca4 Release 8.5.27 version
• 62b1626 Fix linter
• 1dba938 Update dependencies
• 3e82edc Keep non-annotation comments when the processor has no plugins (#2150)
• 6d23bc3 Fix link
• 508e997 Add GitHub Sponsors link
• e993739 Add CodeRabbit sponsor (#2145)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for postcss since your current version.

Updates tailwind-merge from 3.0.2 to 3.6.0

Commits

• See full diff in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for tailwind-merge since your current version.

Updates @playwright/test from 1.62.0 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
bit-cryptic-world	Ready	Preview	Sep 15, 2026 7:07am UTC