chore(deps)(deps-dev): bump the dev-dependencies group across 1 directory with 6 updates

[dependabot]

Bumps the dev-dependencies group with 6 updates in the / directory:

Package	From	To
@playwright/test	1.62.1	1.63.0
@typescript-eslint/parser	8.69.0	8.70.0
@typescript-eslint/types	8.69.0	8.70.0
cspell	10.2.1	10.3.0
lint-staged	17.4.1	17.5.1
wrangler	4.129.0	4.131.0

Updates @playwright/test from 1.62.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates @typescript-eslint/parser from 8.69.0 to 8.70.0

Release notes

Sourced from @​typescript-eslint/parser's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/parser's changelog.

8.70.0 (2026-09-07)

This was a version bump only for parser to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• See full diff in compare view

Updates @typescript-eslint/types from 8.69.0 to 8.70.0

Release notes

Sourced from @​typescript-eslint/types's releases.

v8.70.0

8.70.0 (2026-09-07)

🚀 Features

• eslint-plugin: [no-generated-empty-object-type] add rule (#12730)
• website: generate per-page social preview cards (#12734)

🩹 Fixes

• use stable release of pnpm 12 (#12808)
• update pnpm to 12.3.4 and dedupe Docusaurus packages (#12829)
• eslint-plugin: [member-ordering] don't report fields that read fields declared before them (#12729)
• eslint-plugin: [no-unnecessary-condition] no false positive on RHS of a nested logical expression (#12728)
• eslint-plugin: [no-deprecated] report deprecated imported values used in object shorthand properties (#12780)
• project-service: avoid discarded tsserver logs (#12748)
• typescript-estree: clarify the parserOptions.project error message (#12817)

❤️ Thank You

• Barry @​barry166
• Evyatar Daud @​StyleShit
• Josh Goldberg
• Josh Goldberg ✨ @​JoshuaKGoldberg
• Kirk Waiblinger @​kirkwaiblinger
• Ulrich Stark @​ulrichstark
• 송재욱

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Changelog

Sourced from @​typescript-eslint/types's changelog.

8.70.0 (2026-09-07)

This was a version bump only for types to align it with other projects, there were no code changes.

See GitHub Releases for more information.

You can read about our versioning strategy and releases on our website.

Commits

• 7ee7608 chore(release): publish 8.70.0
• See full diff in compare view

Updates cspell from 10.2.1 to 10.3.0

Release notes

Sourced from cspell's releases.

v10.3.0

Features

feat: Add an option to set the kind of dictionary file (#9178)

This pull request introduces support for the new kind property in dictionary definitions, enabling explicit specification of dictionary types such as words, flag-words, and ignore-words.

{
  "version": "0.2",
  "language": "en-US",
  "caseSensitive": false,
  "dictionaryDefinitions": [
    {
      "name": "forbidden-spelling",
      "path": "./forbidden-spelling.txt",
      "kind": "flag-words"
    }
  ],
  "dictionaries": ["forbidden-spelling"]
}

forbidden-spelling.txt

# Add forbidden words below.
# Words starting with `!` are exceptions.
# cspell:disable
english:English # Do not allow `english` and suggest `English`
!English # needed to allow `English`
!ENGLISH # needed to allow `ENGLISH`
forbidden_word # All variants of forbidden_word are not allowed.
Mixed case words:
cSpell # only cSpell is flagged. cspell will not be.

It updates the JSON schema, dictionary loading logic, and adds new APIs and tests to handle these kinds, including support for loading forbidden (flag) words from trie files.

Schema and API Enhancements:

• Added a kind property to dictionary definitions in the cspell.schema.json schema, allowing configuration of dictionary type as words, flag-words, or ignore-words [1] [2] [3] [4] [5].
• Updated the internal dictionary settings and loader logic to recognize and handle the new kind property, ensuring correct dictionary instantiation based on its value [1] [2] [3] [4].

Flag Words Dictionary Support:

... (truncated)

Changelog

Sourced from cspell's changelog.

v10.3.0 (2026-09-08)

Features

feat: Add an option to set the kind of dictionary file (#9178)

This pull request introduces support for the new kind property in dictionary definitions, enabling explicit specification of dictionary types such as words, flag-words, and ignore-words.

{
  "version": "0.2",
  "language": "en-US",
  "caseSensitive": false,
  "dictionaryDefinitions": [
    {
      "name": "forbidden-spelling",
      "path": "./forbidden-spelling.txt",
      "kind": "flag-words"
    }
  ],
  "dictionaries": ["forbidden-spelling"]
}

forbidden-spelling.txt

# Add forbidden words below.
# Words starting with `!` are exceptions.
# cspell:disable
english:English # Do not allow `english` and suggest `English`
!English # needed to allow `English`
!ENGLISH # needed to allow `ENGLISH`
forbidden_word # All variants of forbidden_word are not allowed.
Mixed case words:
cSpell # only cSpell is flagged. cspell will not be.

It updates the JSON schema, dictionary loading logic, and adds new APIs and tests to handle these kinds, including support for loading forbidden (flag) words from trie files.

Schema and API Enhancements:

• Added a kind property to dictionary definitions in the cspell.schema.json schema, allowing configuration of dictionary type as words, flag-words, or ignore-words [1] [2] [3] [4] [5].
• Updated the internal dictionary settings and loader logic to recognize and handle the new kind property, ensuring correct dictionary instantiation based on its value [1] [2] [3] [4].

... (truncated)

Commits

• d8abd59 v10.3.0
• a5d6f57 chore: Prepare Release v10.3.0 (auto-deploy) (#9186)
• 3929707 v10.3.0-alpha.0
• 816dd40 chore: Prepare Release v10.3.0-alpha.0 (auto-deploy) (#9175)
• fffea2a fix: Only hide code-like partial words (#9163)
• 22fae7a v10.2.2
• 2379489 chore: Prepare Release v10.2.2 (auto-deploy) (#9158)
• See full diff in compare view

Updates lint-staged from 17.4.1 to 17.5.1

Release notes

Sourced from lint-staged's releases.

v17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

v17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

Changelog

Sourced from lint-staged's changelog.

17.5.1

Patch Changes

• #1852 bfcca94 - Fix TypeScript issue TS1254 from defineConfig() by changing the signature from const to a function:

  A 'const' initializer in an ambient context must be a string or numeric literal or literal enum reference.

17.5.0

Minor Changes

• #1847 f9063b7 - Lint-staged now refuses to run when files were staged with --intent-to-add, because Git stash doesn't support them. Previously this was an unhandled error.

Patch Changes

• #1848 d718ccc - Lint-staged now handles color support better in non-TTY streams, and honors the FORCE_COLOR environment variable.

• #1845 7e5ece8 - Update tinyexec@1.3.1 so that local binaries from node_modules/.bin are resolved starting from the directory of each lint-staged configuration file (in monorepo setups). This behavior was broken in lint-staged@16.3.0 where they were only resolved from the current working directory and up.

• #1845 eb8a4e3 - Do not try to restore untracked files when using --hide-all and there is no initial commit yet.

Commits

• f8b1ab1 Merge pull request #1853 from lint-staged/changeset-release/main
• 3b54961 chore(changeset): release
• 09317ff Merge pull request #1852 from lint-staged/fix-ambient-declaration
• bfcca94 fix: change defineConfig signature from const to a function
• dcb59f6 Merge pull request #1846 from lint-staged/changeset-release/main
• 9c8c6dc chore(changeset): release
• 586466f Merge pull request #1849 from lint-staged/improve-intent-to-add
• 45eda5f refactor: improve --intent-to-add detection
• 26372e3 Merge pull request #1848 from lint-staged/fix-color-detection
• d718ccc fix: honor FORCE_COLOR/NO_COLOR env variables in non-TTY streams
• Additional commits viewable in compare view

Updates wrangler from 4.129.0 to 4.131.0

Release notes

Sourced from wrangler's releases.

wrangler@4.131.0

Minor Changes

• #15480 36aed7f Thanks @​skepticfx! - Add Durable Object-managed Containers to top-level container configuration

  Wrangler now accepts scheduling_policy: "durable_object" in the top-level containers array and creates its namespace-backed application after the Worker upload resolves the Durable Object namespace ID. The namespace ID is also the application ID, so repeated deploys idempotently ensure the same application without name-based lookup, modification, or a Containers rollout.

  Durable Object-managed entries accept class_name, scheduling_policy, an optional name, and an optional named images map. Scheduler-only fields are rejected. Each image provides either a local dockerfile or a digest-pinned managed-registry image. Wrangler builds or resolves each image, waits while Cloudflare prepares it for the Containers runtime, and uploads the resulting references with the Worker version for access through ctx.container.images and env.EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES. Local development support for these entries is deferred to a follow-up.

  Existing scheduler-backed entries and Durable Object migrations continue to work unchanged.

  With --containers-rollout=none, existing Workers retain their deployed Container metadata and image binding even when local containers is omitted or empty; local scheduler edits are also ignored. The upload stops if the deployed versions cannot be recovered. Existing Workers for Platforms dispatch scripts reject this flag before upload because their API does not expose enough metadata to preserve Container associations safely. First deployments can still skip Container preparation and rollout. Without this flag, removing managed Containers, including by omitting containers entirely, clears the experimental image binding even with keep_vars.

  versions deploy validates the selected versions before changing traffic and creates their Durable Object-managed applications only after deployment succeeds. Both deploy and versions deploy report partial completion if application creation fails afterward, with instructions to retry the same command.

  EXPERIMENTAL_CLOUDFLARE_CONTAINER_IMAGES is a temporary, reserved Wrangler binding until native Container image metadata is available. Its class keys identify managed applications during versions deploy, including classes with empty image maps. User configuration cannot declare a binding with this name; existing versions that already use it are treated as Container configuration.

• #15493 493e635 Thanks @​GregBrimble! - Remove wrangler preview settings commands

  The private-beta wrangler preview settings and wrangler preview settings update commands are no longer available.

Patch Changes

• #15411 0b43395 Thanks @​xgame92! - Fail wrangler versions upload early when a Worker has a pending Durable Object migration

  Wrangler now directs users to run wrangler deploy to apply the migration instead of sending a version upload request that the API will reject.

• #15518 9d75006 Thanks @​taylorlee! - Detect named-only module Worker entrypoints correctly

  Wrangler now distinguishes named-only module Workers from legacy Service Workers that happen to have named exports. A default export identifies a module Worker; otherwise, legacy addEventListener registration identifies Service Worker format.

• #15581 b605aa6 Thanks @​MattieTK! - Correct Pages-to-Workers delegation analytics for forced and ineligible commands

  The legacy forced result counted every agent-driven Pages command using --force, including commands that could never have been delegated. Wrangler now emits eligible_forced only when --force prevents an otherwise eligible delegation, and records other agent commands as ineligible with a bounded reason and whether force was used.

• #15432 f45b596 Thanks @​razethion! - Prevent delayed internal errors from fetch-only remote bindings

  Fetch-only remote bindings such as D1 and R2 previously opened an unused WebSocket RPC session. RPC sessions are now created only when an RPC method is called.

• #15585 f69f95a Thanks @​dependabot! - Update dependencies of "miniflare", "wrangler"

  The following dependency versions have been updated:

  Dependency	From	To
  @​cloudflare/workers-types	^5.20260908.1	^5.20260910.1
  workerd	1.20260908.1	1.20260910.1

• #15554 bff525d Thanks @​XiaoZ-0218! - Add the missing transferred_classes migration to the config schema

... (truncated)

Commits

• 41d7366 Version Packages (#15568)
• b605aa6 [wrangler] Correct Pages delegation analytics (#15581)
• 96688b3 fix(deps): bump shell-quote to patch CVE-2026-9277 / CVE-2026-13311 (#15584)
• 24ef86b [wrangler] Handle dynamic retry delays in workflows instances describe (#15569)
• 36aed7f CC-8364 Add top-level Durable Object-managed Containers (#15480)
• f8aea7e Replace remaining preview_defaults references with previews_base_config (...
• 9d75006 [wrangler] Fix named-only module Worker format detection (#15518)
• 128235a [wrangler] Fix types --strict-vars=false emitting invalid TypeScript for an...
• bff525d fix(wrangler): include transferred_classes in DurableObjectMigration schema (...
• 493e635 Remove the wrangler preview settings and wrangler preview settings update...
• Additional commits viewable in compare view

[github-actions]

Preview deployment

Status	URL
Skipped	-

Commit: b37a64c
Updated: 2026-09-14T06:22:36.874Z

Reason: Dependabot-triggered workflows do not have access to repository secrets in this workflow.

If you want a preview deployment, please ask a maintainer to run this from a branch within the main repository.