Bump the development_dependencies group across 1 directory with 16 updates

[dependabot]

Bumps the development_dependencies group with 16 updates in the / directory:

Package	From	To
@changesets/cli	2.31.0	2.31.1
@nx/eslint-plugin	22.7.7	22.7.12
@nx/workspace	22.7.7	22.7.12
@types/node	22.20.1	22.20.2
json-stringify-deterministic	1.0.14	1.0.16
nx	22.7.7	22.7.12
oclif	4.23.27	4.24.0
pin-github-action	3.5.1	3.5.2
vitest	4.1.10	4.1.11
@oclif/plugin-commands	4.1.60	4.2.0
@oclif/plugin-plugins	5.4.84	5.5.2
@types/lodash	4.17.24	4.17.25
node-stream-zip	1.15.0	1.16.0
@playwright/test	1.61.1	1.63.0
tsx	4.23.1	4.23.13
@testing-library/react	16.3.2	16.3.3

Updates @changesets/cli from 2.31.0 to 2.31.1

Release notes

Sourced from @​changesets/cli's releases.

@​changesets/cli@​2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Changelog

Sourced from @​changesets/cli's changelog.

2.31.1

Patch Changes

• #2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

Commits

• e8650b9 Version Packages (#2161)
• 15cf592 Fixed handling of the npm 12 info output (#2159)
• See full diff in compare view

Updates @nx/eslint-plugin from 22.7.7 to 22.7.12

Release notes

Sourced from @​nx/eslint-plugin's releases.

22.7.12 (2026-09-10)

🩹 Fixes

• core: box JsonFileSet payload to keep HashInstruction small (#36247, #35248, #36244, #36152)
• core: replace per-input visited clones with undo-log scoping in hash planner (#36248, #35071, #36152, #34971, #36244, #35248, #36247)
• core: intern hash instructions in a pool and plan with id lists (#36249, #35071, #36152, #36248, #36244)
• core: fall back to v8 for oversized daemon responses and length-prefix the wire protocol (#36838, #36850, #36794, #36754)
• core: remove redundant allWorkspaceFiles from the project graph pipeline (#34425)
• core: share workspace fileset hash results instead of deep-cloning per task (#36244, #34971, #34942)
• core: reduce task hashing memory usage on large workspaces (#36267, #36152, #36249)
• core: avoid mutating target options when resolving configurations (#36934)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez
• Nicolas Beaussart @​beaussan

22.7.11 (2026-09-09)

🩹 Fixes

• core: release per-run process listeners and task history results (#36974, #36866)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz

22.7.10 (2026-09-09)

🩹 Fixes

• core: validate the migrations path before extracting package migrations (#36887)

❤️ Thank You

• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez

22.7.9 (2026-09-01)

🩹 Fixes

• core: restrict daemon and plugin worker socket access to the owning user (#36370, #36586, #36463)
• core: compare daemon workspace roots case-insensitively on Windows (#36835, #36722)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)

... (truncated)

Commits

• See full diff in compare view

Updates @nx/workspace from 22.7.7 to 22.7.12

Release notes

Sourced from @​nx/workspace's releases.

22.7.12 (2026-09-10)

🩹 Fixes

• core: box JsonFileSet payload to keep HashInstruction small (#36247, #35248, #36244, #36152)
• core: replace per-input visited clones with undo-log scoping in hash planner (#36248, #35071, #36152, #34971, #36244, #35248, #36247)
• core: intern hash instructions in a pool and plan with id lists (#36249, #35071, #36152, #36248, #36244)
• core: fall back to v8 for oversized daemon responses and length-prefix the wire protocol (#36838, #36850, #36794, #36754)
• core: remove redundant allWorkspaceFiles from the project graph pipeline (#34425)
• core: share workspace fileset hash results instead of deep-cloning per task (#36244, #34971, #34942)
• core: reduce task hashing memory usage on large workspaces (#36267, #36152, #36249)
• core: avoid mutating target options when resolving configurations (#36934)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez
• Nicolas Beaussart @​beaussan

22.7.11 (2026-09-09)

🩹 Fixes

• core: release per-run process listeners and task history results (#36974, #36866)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz

22.7.10 (2026-09-09)

🩹 Fixes

• core: validate the migrations path before extracting package migrations (#36887)

❤️ Thank You

• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez

22.7.9 (2026-09-01)

🩹 Fixes

• core: restrict daemon and plugin worker socket access to the owning user (#36370, #36586, #36463)
• core: compare daemon workspace roots case-insensitively on Windows (#36835, #36722)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)

... (truncated)

Commits

• 36cd492 fix(core): acknowledge @​swc/core build script in generated pnpm-workspace.yaml
• 31a9bdc fix(core): allow nx build scripts in generated pnpm-workspace.yaml (#35564)
• 23d2a55 fix(misc): use default import for chalk in @​nx/workspace output.ts (#35523)
• See full diff in compare view

Updates @types/node from 22.20.1 to 22.20.2

Commits

• See full diff in compare view

Updates json-stringify-deterministic from 1.0.14 to 1.0.16

Release notes

Sourced from json-stringify-deterministic's releases.

v1.0.16

Full Changelog: Kikobeats/json-stringify-deterministic@v1.0.15...v1.0.16

v1.0.15

What's Changed

• build(deps): bump actions/setup-node from 6 to 7 by @​dependabot[bot] in Kikobeats/json-stringify-deterministic#29

Full Changelog: Kikobeats/json-stringify-deterministic@v1.0.14...v1.0.15

Changelog

Sourced from json-stringify-deterministic's changelog.

1.0.16 (2026-08-03)

1.0.15 (2026-07-30)

Commits

• 9788765 chore(release): 1.0.16
• 82d6a3a ci(dependabot): ignore actions minor/patch
• 7569546 chore(release): 1.0.15
• bb1c82f build: contributors
• edc795d chore: improve npm search metadata
• 5fd9744 build(deps): bump actions/setup-node from 6 to 7 (#29)
• See full diff in compare view

Updates nx from 22.7.7 to 22.7.12

Release notes

Sourced from nx's releases.

22.7.12 (2026-09-10)

🩹 Fixes

• core: box JsonFileSet payload to keep HashInstruction small (#36247, #35248, #36244, #36152)
• core: replace per-input visited clones with undo-log scoping in hash planner (#36248, #35071, #36152, #34971, #36244, #35248, #36247)
• core: intern hash instructions in a pool and plan with id lists (#36249, #35071, #36152, #36248, #36244)
• core: fall back to v8 for oversized daemon responses and length-prefix the wire protocol (#36838, #36850, #36794, #36754)
• core: remove redundant allWorkspaceFiles from the project graph pipeline (#34425)
• core: share workspace fileset hash results instead of deep-cloning per task (#36244, #34971, #34942)
• core: reduce task hashing memory usage on large workspaces (#36267, #36152, #36249)
• core: avoid mutating target options when resolving configurations (#36934)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz
• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez
• Nicolas Beaussart @​beaussan

22.7.11 (2026-09-09)

🩹 Fixes

• core: release per-run process listeners and task history results (#36974, #36866)

❤️ Thank You

• Craigory Coppola @​AgentEnder
• FrozenPandaz @​FrozenPandaz

22.7.10 (2026-09-09)

🩹 Fixes

• core: validate the migrations path before extracting package migrations (#36887)

❤️ Thank You

• Jason Jean @​FrozenPandaz
• Leosvel Pérez Espinosa @​leosvelperez

22.7.9 (2026-09-01)

🩹 Fixes

• core: restrict daemon and plugin worker socket access to the owning user (#36370, #36586, #36463)
• core: compare daemon workspace roots case-insensitively on Windows (#36835, #36722)
• core: close daemon log descriptors after spawn to avoid Node 26 crash (#36280)

... (truncated)

Commits

• 7c5b4dc docs(core): correct the NX_MAX_MESSAGE_SIZE row and drop a stale clause
• 3163430 chore(core): format daemon client with prettier
• ab613f7 chore(core): satisfy cargo fmt on the backported hash planner
• 1cffd59 fix(core): avoid mutating target options when resolving configurations (#36934)
• 8d81ae2 fix(core): reduce task hashing memory usage on large workspaces (#36267)
• bfd3e51 fix(core): share workspace fileset hash results instead of deep-cloning per t...
• 02f82fa cleanup(core): persist file-set hash caches on the TaskHasher instance (#36118)
• 2c34a3b fix(core): remove redundant allWorkspaceFiles from the project graph pipeli...
• 73a415b fix(core): fall back to v8 for oversized daemon responses and length-prefix t...
• a25009d fix(core): intern hash instructions in a pool and plan with id lists (#36249)
• Additional commits viewable in compare view

Updates oclif from 4.23.27 to 4.24.0

Release notes

Sourced from oclif's releases.

4.24.0

Features

• bumping to eslint v10 (W-23473845) (4ea4d88)

4.23.32

Bug Fixes

• deps: bump @​oclif/plugin-warn-if-update-available (e1304d2)

4.23.31

Bug Fixes

• deps: bump @​oclif/plugin-not-found from 3.2.87 to 3.2.93 (7a2a295)

4.23.30

Bug Fixes

• deps: bump fast-uri from 3.1.4 to 3.1.5 (6a99532)

4.23.29

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (75894c9)

4.23.28

Bug Fixes

• pinned certain tests to TS6 (W-23513992) (#2076) (536f8cd)

Changelog

Sourced from oclif's changelog.

4.24.0 (2026-08-24)

Features

• bumping to eslint v10 (W-23473845) (4ea4d88)

4.23.32 (2026-08-24)

Bug Fixes

• deps: bump @​oclif/plugin-warn-if-update-available (e1304d2)

4.23.31 (2026-08-24)

Bug Fixes

• deps: bump @​oclif/plugin-not-found from 3.2.87 to 3.2.93 (7a2a295)

4.23.30 (2026-08-06)

Bug Fixes

• deps: bump fast-uri from 3.1.4 to 3.1.5 (6a99532)

4.23.29 (2026-07-25)

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (75894c9)

4.23.28 (2026-07-20)

Bug Fixes

• pinned certain tests to TS6 (W-23513992) (#2076) (536f8cd)

Commits

• 9de14c1 chore(release): 4.24.0 [skip ci]
• 0ea2014 Merge pull request #2079 from oclif/d/W-23473845
• 4ea4d88 feat: bumping to eslint v10 (W-23473845)
• 70f92fa chore(release): 4.23.32 [skip ci]
• bebf92c Merge pull request #2065 from oclif/dependabot-npm_and_yarn-oclif-plugin-warn...
• e1304d2 fix(deps): bump @​oclif/plugin-warn-if-update-available
• 27e346c chore(release): 4.23.31 [skip ci]
• 6d2e292 Merge pull request #2073 from oclif/dependabot-npm_and_yarn-oclif-plugin-not-...
• 7a2a295 fix(deps): bump @​oclif/plugin-not-found from 3.2.87 to 3.2.93
• b6b6a8b chore(release): 4.23.30 [skip ci]
• Additional commits viewable in compare view

Updates pin-github-action from 3.5.1 to 3.5.2

Release notes

Sourced from pin-github-action's releases.

v3.5.2

What's Changed

• fix: support new self-repository syntax by @​ivorisoutdoors in mheap/pin-github-action#220
• Update dependencies by @​mheap in mheap/pin-github-action#221

New Contributors

• @​ivorisoutdoors made their first contribution in mheap/pin-github-action#220

Full Changelog: mheap/pin-github-action@v3.5.1...v3.5.2

Commits

• c20721a 3.5.2
• 76c85e4 Update dependencies (#221)
• a396b25 fix: support new self-repository syntax (#220)
• See full diff in compare view

Updates vitest from 4.1.10 to 4.1.11

Release notes

Sourced from vitest's releases.

v4.1.11

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in vitest-dev/vitest#10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in vitest-dev/vitest#10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in vitest-dev/vitest#10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in vitest-dev/vitest#10974 (fe5a1)

    View changes on GitHub

Commits

• 9bd8d46 chore: release v4.1.11 (#10995)
• 9851dbc fix(browser): trigger playwright/chromium gc on lower disk availability [back...
• See full diff in compare view

Updates @oclif/plugin-commands from 4.1.60 to 4.2.0

Release notes

Sourced from @​oclif/plugin-commands's releases.

4.2.0

Features

• bumping eslint to v10 (W-23473845) (#1169) (67d4bf6)

4.1.63

Bug Fixes

• deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1168) (7406def)

4.1.62

Bug Fixes

• deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1162) (21c4688)

4.1.61

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1159) (f20466f)

Changelog

Sourced from @​oclif/plugin-commands's changelog.

4.2.0 (2026-08-24)

Features

• bumping eslint to v10 (W-23473845) (#1169) (67d4bf6)

4.1.63 (2026-08-08)

Bug Fixes

• deps: bump @​oclif/core from 4.13.2 to 4.13.3 (#1168) (7406def)

4.1.62 (2026-08-01)

Bug Fixes

• deps: bump @​oclif/core from 4.13.0 to 4.13.2 (#1162) (21c4688)

4.1.61 (2026-07-25)

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1159) (f20466f)

Commits

• dedb507 chore(release): 4.2.0 [skip ci]
• 67d4bf6 feat: bumping eslint to v10 (W-23473845) (#1169)
• df00e13 chore(dev-deps): bump @​oclif/test from 4.1.21 to 4.1.22 (#1170)
• afeef2b chore(dev-deps): bump @​oclif/plugin-help from 6.2.56 to 6.2.58 (#1171)
• 4addd2f chore(dev-deps): bump oclif from 4.23.29 to 4.23.30 (#1172)
• 12e5223 chore(dev-deps): bump @​types/lodash from 4.17.24 to 4.17.25 (#1165)
• 9ed7221 chore(dev-deps): bump mocha from 11.7.6 to 11.8.0 (#1166)
• a580534 chore(dev-deps): bump @​oclif/plugin-help from 6.2.55 to 6.2.56 (#1167)
• 2f728ee chore(release): 4.1.63 [skip ci]
• 7406def fix(deps): bump @​oclif/core from 4.13.2 to 4.13.3 (#1168)
• Additional commits viewable in compare view

Updates @oclif/plugin-plugins from 5.4.84 to 5.5.2

Release notes

Sourced from @​oclif/plugin-plugins's releases.

5.5.2

Bug Fixes

• handle spaces in process.execPath on Windows @​W-23997746@ (c34c18e), closes oclif/plugin-plugins#1387
• test: fix spawn tests for Windows CI (a2784ea)
• test: skip symlink-based test on Windows (4288372)

5.5.1

Bug Fixes

• use process.execPath for .js module spawning on all platforms @​W-21984392@ (8b24637)

5.5.0

Features

• bumping eslint to v10 (W-23473845) (#1384) (7f322bc)

5.4.87

Bug Fixes

• pass cwd to npmRunPathEnv to prevent PATH hijack @​W-23797722@ (5450125)

5.4.86

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1372) (ff69aa0)

5.4.85

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (#1376) (03d03cd)

Changelog

Sourced from @​oclif/plugin-plugins's changelog.

5.5.2 (2026-08-27)

Bug Fixes

• handle spaces in process.execPath on Windows @​W-23997746@ (c34c18e), closes oclif/plugin-plugins#1387
• test: fix spawn tests for Windows CI (a2784ea)
• test: skip symlink-based test on Windows (4288372)

5.5.1 (2026-08-20)

Bug Fixes

• use process.execPath for .js module spawning on all platforms @​W-21984392@ (8b24637)

5.5.0 (2026-08-19)

Features

• bumping eslint to v10 (W-23473845) (#1384) (7f322bc)

5.4.87 (2026-08-14)

Bug Fixes

• pass cwd to npmRunPathEnv to prevent PATH hijack @​W-23797722@ (5450125)

5.4.86 (2026-07-25)

Bug Fixes

• deps: bump @​oclif/core from 4.11.14 to 4.13.0 (#1372) (ff69aa0)

5.4.85 (2026-07-25)

Bug Fixes

• deps: bump fast-uri from 3.1.2 to 3.1.4 (#1376) (03d03cd)

Commits

• ef73dec chore(release): 5.5.2 [skip ci]
• cff2c7c Merge pull request #1388 from oclif/wr/fixSpawnExecPathSpaces
• 4288372 fix(test): skip symlink-based test on Windows
• b5b5926 chore: retrigger tests
• 24a3185 ci: use lts/* instead of latest for integration tests
• a2784ea fix(test): fix spawn tests for Windows CI
• e8cf5ad test: add security regression guard for windowsVerbatimArguments
• c34c18e fix: handle spaces in process.execPath on Windows @​W-23997746@
• 9ef077f chore(release): 5.5.1 [skip ci]
• 4f293dd Merge pull request #1383 from oclif/wr/fixSpawnEnoentOnUnixTarballs
• Additional commits viewable in compare view

Updates @types/lodash from 4.17.24 to 4.17.25

Commits

• See full diff in compare view

Updates node-stream-zip from 1.15.0 to 1.16.0

Changelog

Sourced from node-stream-zip's changelog.

v1.16.0 (2026-07-22)

+ fixed reading compressed entry size to prevent exploitation reported by @​DumDumSu
* updated dependencies

Commits

• 2d9da01 release 1.16.0
• d6646bf up deps
• b9b496a fixed reading compressed entry size
• a050b3f fixed tests
• 7c5d503 readme
• c7cd392 removed a duplicated test
• f58b5b8 node.js 14
• 74f30a3 node.js 12
• 571f55b node.js 12
• See full diff in compare view

Updates @playwright/test from 1.61.1 to 1.63.0

Release notes

Sourced from @​playwright/test's releases.

v1.63.0

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock. Tests that share a lock name never run concurrently, across files, workers and projects, while everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group. Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments, and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API

... (truncated)

Commits

• 1b025d7 chore: mark v1.63.0 (#42569)
• 0b9956d cherry-pick(#42568): docs(test): mark test.step subtitle option as since v1.63
• 13dbf10 cherry-pick(#42552): docs: release notes for v1.63
• e93b64e cherry-pick(#42566): feat(test): add subtitle option to test.step (#42567)
• 2b7a5f2 test: response.body() for content-encoding:identity (#42537)
• 648a67c fix(mcp): create parent directories for explicitly named files (#42540)
• 7894f56 docs(mcp): clarify how tool file names are resolved (#42538)
• 52900a1 devops: restore npm publishing from GitHub Actions (#42550)
• 8c47f59 docs(csharp): fix nonexistent method names in guide examples (#42507)
• bd6e552 chore(video): emit frames with real timestamps, drop frame number quantizatio...
• Additional commits viewable in compare view

Updates tsx from 4.23.1 to 4.23.13

Release notes

Sourced from tsx's releases.

v4.23.13

4.23.13 (2026-08-30)

Bug Fixes

• cache: bound shared transform cache memory (#835) (28e1f12)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.12

4.23.12 (2026-08-10)

Bug Fixes

• shim import.meta when tokens are split by comments or newlines (#829) (ed9d330), closes #828

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.11

4.23.11 (2026-08-07)

Bug Fixes

• preserve async ESM require fallback (55cbece)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.10

4.23.10 (2026-08-07)

Bug Fixes

• support nyc coverage discovery (#710) (ec1bcd5)

---

This release is also available on:

• npm package (@​latest dist-tag)

v4.23.9

4.23.9 (2026-08-06)

... (truncated)

Commits

• 28e1f12 fix(cache): bound shared transform cache memory (#835)
• ed9d330 fix: shim import.meta when tokens are split by comments or newlines (#829)
• 651f5be test: cover CommonJS TypeScript import.meta paths
• bd3bc64 test: cover CommonJS loader source fallback
• 55cbece fix: preserve async ESM require fallback
• 6c5ba85 docs: document CommonJS default interop
• ec1bcd5 fix: support nyc coverage discovery (#710)
• b6e5b48 docs: clarify CommonJS default imports
• 2f55884 fix: map Node test locations
• de935d5 docs: document Node source-map stack formatting
• Additional commits viewable in compare view

Updates @testing-library/react from 16.3.2 to 16.3.3

Release notes

Sourced from @​testing-library/react's releases.

v16.3.3

16.3.3 (2026-08-27)

Bug Fixes

• Avoid act() re-entrant when dispatching events (#1468) (20ce75f)

Commits

• 20ce75f fix: Avoid act() re-entrant when dispatching events (