chore(deps): bump the javascript group across 1 directory with 6 updates

[dependabot]

Bumps the javascript group with 6 updates in the /js directory:

Package	From	To
tar	7.5.15	7.5.19
@types/node	25.9.1	26.0.1
playwright-core	1.60.0	1.61.1
puppeteer-core	25.0.4	25.2.1
socks-proxy-agent	10.0.0	10.1.0
vitest	1.6.1	3.2.6

Updates tar from 7.5.15 to 7.5.19

Commits

• be440da 7.5.19
• 2812e93 add maxDecompressionRatio guard against explosive decompression
• 9ecd4d2 7.5.18
• 9e78bf0 refuse to let header size be less than 0
• e02a4e9 pax: parse values according to known types
• 9cbdb31 7.5.17
• 7a635c2 terminate pax strings on nul bytes
• cf21338 7.5.16
• 21a8220 do not apply PAX header fields to meta entries
• 52632cf update project deps
• Additional commits viewable in compare view

Updates @types/node from 25.9.1 to 26.0.1

Commits

• See full diff in compare view

Updates playwright-core from 1.60.0 to 1.61.1

Release notes

Sourced from playwright-core's releases.

v1.61.1

Bug Fixes

• #41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();
// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
id: credentialId,
userHandle,
privateKey,
publicKey,
});
await context.credentials.install();
const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

... (truncated)

Commits

• 39e3553 cherry-pick(#41399): fix(test): load require-reached files as commonjs in syn...
• 4328122 chore: mark v1.61.1 (#41404)
• 2c29a94 fix(tracing): stop recording websocket frames outside of chunks (#41398)
• 4324b19 cherry-pick(#41367): fix(test): keep builtin expect matchers on base extend
• 041e7e3 cherry-pick(#41364): fix(har): WebSocket message timestamps should be in mi...
• b8a0fc3 cherry-pick(#41309, #43149): Revert "fix(firefox): treat `navigationCommitted...
• b5a3175 cherry-pick(#41319): fix(loader): support other node versions
• d4724a9 cherry-pick(#41290): feat(docker): add Ubuntu 26.04 (Resolute Raccoon) image
• 1cc5a90 cherry-pick(#41295): chore: PLAYWRIGHT_TRACING_NO_WEBSOCKET_FRAMES and PLAYWR...
• a6772bd cherry-pick(#41280): Revert "fix(trace-viewer): add keyboard navigation to `N...
• Additional commits viewable in compare view

Updates puppeteer-core from 25.0.4 to 25.2.1

Release notes

Sourced from puppeteer-core's releases.

puppeteer-core: v25.2.1

25.2.1 (2026-06-24)

🛠️ Fixes

• regression when using Puppeteer with untrusted sessions (#15150) (801c212)
• roll to Firefox 152.0.2 (#15153) (d2908b2)

puppeteer-core: v25.2.0

25.2.0 (2026-06-22)

🎉 Features

• add page locale emulation (#15075) (c528f65)
• add waitForFunction to webWorkers (#15100) (0bdfa77)
• allow extensions to run over websockets (#15059) (b84d8a1)
• roll to Chrome 150.0.7871.24 (#15126) (b74ed1c)
• roll to Firefox 152.0 (#15125) (87be906)

🛠️ Fixes

• apply allowlist to non-auto-attach sessions (#15136) (5c7a0e0)
• await for Worker script exection (#15099) (dc469b8)
• block service worker registrations (#15135) (d03617c)
• correct screencast frame timing so playback matches real time (#15112) (525b384)
• remove global skipDownload early return to include other configs (#15130) (5b1cb20)
• roll to Firefox 152.0.1 (#15134) (fd12dd6)
• webmcp: invalidate webmcp tools on context destruction (#15068) (8e9c0fa)

📄 Documentation

• clarify the network allowlist/blocklist implementation (#15148) (a7f124c)
• Update Page.target deprecation message to cover broader usage. (#15108) (882c43d)

⚡ Performance

• cdp: parallelize extension workers fetching (#15057) (fdee509)
• optimize headersArray iteration in HTTPRequest (#15004) (eb95798)
• optimize property descriptors iteration in JSHandle (#15094) (2483b65)
• parallelize iframe population in accessibility snapshots (#15083) (7e3d42e)

🏗️ Refactor

• sync accessing debugger (#15066) (9046239)

... (truncated)

Changelog

Sourced from puppeteer-core's changelog.

25.2.1 (2026-06-24)

♻️ Chores

• puppeteer: Synchronize puppeteer versions

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • puppeteer-core bumped from 25.2.0 to 25.2.1

🛠️ Fixes

• regression when using Puppeteer with untrusted sessions (#15150) (801c212)
• roll to Firefox 152.0.2 (#15153) (d2908b2)

25.2.0 (2026-06-22)

🎉 Features

• add page locale emulation (#15075) (c528f65)
• add waitForFunction to webWorkers (#15100) (0bdfa77)
• allow extensions to run over websockets (#15059) (b84d8a1)
• roll to Chrome 150.0.7871.24 (#15126) (b74ed1c)
• roll to Firefox 152.0 (#15125) (87be906)

🛠️ Fixes

• apply allowlist to non-auto-attach sessions (#15136) (5c7a0e0)
• await for Worker script exection (#15099) (dc469b8)
• block service worker registrations (#15135) (d03617c)
• correct screencast frame timing so playback matches real time (#15112) (525b384)
• remove global skipDownload early return to include other configs (#15130) (5b1cb20)
• roll to Firefox 152.0.1 (#15134) (fd12dd6)
• webmcp: invalidate webmcp tools on context destruction (#15068) (8e9c0fa)

Dependencies

• The following workspace dependencies were updated
  • dependencies
    • @​puppeteer/browsers bumped from 3.0.4 to 3.0.5

... (truncated)

Commits

• 4a56c69 chore: release main (#15152)
• d2908b2 fix: roll to Firefox 152.0.2 (#15153)
• 801c212 fix: regression when using Puppeteer with untrusted sessions (#15150)
• 0496143 chore: release main (#15064)
• a7f124c docs: clarify the network allowlist/blocklist implementation (#15148)
• 036503e test: add iframe tests (#15149)
• 2d71ccc chore: fix regression of debug logs (#15147)
• 5b1cb20 fix: remove global skipDownload early return to include other configs (#15130)
• 1106b6e chore(deps): bump the all group in /website with 2 updates (#15143)
• f14e4ad chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 in the all group (#15144)
• Additional commits viewable in compare view

Updates socks-proxy-agent from 10.0.0 to 10.1.0

Release notes

Sourced from socks-proxy-agent's releases.

socks-proxy-agent@10.1.0

Minor Changes

• 3ebf4b2: Add proxy event emission on the request object for all proxy agents. After the proxy connection is established, the request emits a proxy event with { proxy, socket } where proxy is the proxy URL string. This is useful for debugging and logging which proxy was used for a connection.

Changelog

Sourced from socks-proxy-agent's changelog.

10.1.0

Minor Changes

• 3ebf4b2: Add proxy event emission on the request object for all proxy agents. After the proxy connection is established, the request emits a proxy event with { proxy, socket } where proxy is the proxy URL string. This is useful for debugging and logging which proxy was used for a connection.

Commits

• 065d1ff Version Packages (#416)
• 3ebf4b2 feat: add proxy event emission on request for all proxy agents (#422)
• 8761b47 fix: log error message on each E2E retry attempt
• 434d237 fix: increase E2E test timeout to 120s for retry headroom
• 671a314 fix: retry NordVPN E2E proxy tests with different servers on failure (#419)
• See full diff in compare view

Updates vitest from 1.6.1 to 3.2.6

Release notes

Sourced from vitest's releases.

v3.2.6

   🐞 Bug Fixes

• Pin last supported vite-node version  -  by @​sheremet-va (16f12)

    View changes on GitHub

v3.2.5

   🚀 Features

• api: Add allowWrite and allowExec options to api [backport to v3]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10445 (af88b)

   🐞 Bug Fixes

• browser: Disable client cdp API when allowWrite/allowExec: false [backport to v3]  -  by @​hi-ogawa and Codex in vitest-dev/vitest#10456 (385a1)

    View changes on GitHub

v3.2.4

   🐞 Bug Fixes

• Use correct path for optimisation of strip-literal  -  by @​mrginglymus in vitest-dev/vitest#8139 (44940)
• Print uint and buffer as a simple string  -  by @​sheremet-va in vitest-dev/vitest#8141 (b86bf)
• browser:
  • Show a helpful error when spying on an export  -  by @​sheremet-va in vitest-dev/vitest#8178 (56007)
• cli:
  • vitest run --watch should be watch-mode  -  by @​AriPerkkio in vitest-dev/vitest#8128 (657e8)
  • Use absolute path environment on Windows  -  by @​colinaaa in vitest-dev/vitest#8105 (85dc0)
  • Throw error when --shard x/<count> exceeds count of test files  -  by @​AriPerkkio in vitest-dev/vitest#8112 (8a18c)
• coverage:
  • Ignore SCSS in browser mode  -  by @​sheremet-va in vitest-dev/vitest#8161 (0c3be)
• deps:
  • Update all non-major dependencies  -  in vitest-dev/vitest#8123 (93f32)
• expect:
  • Handle async errors in expect.soft  -  by @​lzl0304 in vitest-dev/vitest#8145 (68699)
• pool:
  • Auto-adjust minWorkers when only maxWorkers specified  -  by @​AriPerkkio in vitest-dev/vitest#8110 (14dc0)
• reporter:
  • task.meta should be available in custom reporter's errors  -  by @​AriPerkkio in vitest-dev/vitest#8115 (27df6)
• runner:
  • Preserve handler wrapping on extend  -  by @​pengooseDev in vitest-dev/vitest#8153 (a9281)
• ui:
  • Ensure ui config option works correctly  -  by @​lzl0304 in vitest-dev/vitest#8147 (42eeb)

    View changes on GitHub

v3.2.3

   🚀 Features

• browser: Use base url instead of vitest  -  by @​sheremet-va in vitest-dev/vitest#8126 (1d8eb)

... (truncated)

Commits

• b6d56f8 chore: release v3.2.6
• 16f120d fix: pin last supported vite-node version
• 2cbad0a chore: release v3.2.5
• 385a1ae fix(browser): disable client cdp API when allowWrite/allowExec: false [ba...
• af88b1f feat(api): add allowWrite and allowExec options to api [backport to v3]...
• c666d14 chore: release v3.2.4
• 8a18c8e fix(cli): throw error when --shard x/\<count> exceeds count of test files (#...
• 8abd7cc chore(deps): update tinypool (#8174)
• 93f3200 fix(deps): update all non-major dependencies (#8123)
• 0c3be6f fix(coverage): ignore SCSS in browser mode (#8161)
• Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for vitest since your current version.

Most Recent Ignore Conditions Applied to This Pull Request

Dependency Name	Ignore Conditions
vitest	[>= 4.a, < 5]

[dependabot]

Dependabot can't access a private package registry without explicit configuration. Because of this, Dependabot cannot update this pull request.