chore(deps-js): update javascript dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update	Pending
@iconify-json/simple-icons	1.2.98 → 1.2.99			dependencies	patch
@playwright/test (source)	1.60.0 → 1.63.0			devDependencies	minor	1.64.0
@tailwindcss/vite (source)	4.3.0 → 4.3.3			devDependencies	patch
@vitejs/plugin-vue (source)	6.0.7 → 6.0.9			devDependencies	patch
@vitest/coverage-v8 (source)	4.1.8 → 4.1.11			devDependencies	patch
@vue/test-utils	2.4.10 → 2.5.1			devDependencies	minor
lefthook	2.1.9 → 2.1.17			devDependencies	patch	2.2.1 (+1)
markdownlint-cli2	0.22.1 → 0.23.3			devDependencies	minor
nanoid@3	3.3.19 → 3.3.20			pnpm-workspace.overrides	patch
postcss (source)	8.5.28 → 8.5.29			pnpm-workspace.overrides	patch
reka-ui	2.10.5 → 2.11.0			dependencies	minor
tailwindcss (source)	4.3.0 → 4.3.3			devDependencies	patch
vite (source)	8.0.16 → 8.3.2			devDependencies	minor	8.3.4 (+1)
vitest (source)	^4.1.8 → 4.1.11			devDependencies	pin
vue (source)	3.6.0-beta.17 → 3.6.0-rc.10			dependencies	patch
vue-tsc (source)	3.3.3 → 3.3.12			devDependencies	patch

⚠️ Renovate's pin functionality does not currently wire in the release age for a package, so the Minimum Release Age checks can apply. You will need to manually validate the Minimum Release Age for these package(s).

---

Release Notes

microsoft/playwright (@​playwright/test)

v1.63.0

Compare Source

🔒 Test locks

Tests that access a shared resource — an external service, a global account setting — can now declare a named lock.
Tests that share a lock name never run concurrently, across files, workers and projects, while
everything else keeps running in parallel:

test('update user settings', { lock: 'user-settings' }, async ({ page }) => {
  // never runs at the same time as other tests holding 'user-settings'
});

A test can hold multiple locks, and test.describe() accepts a lock for the whole group.
Learn more about test locks.

🪟 Locate across frames

page.frameLocator() and frame.frameLocator() called without a selector search in any frame of the
subtree, so you no longer need to locate the iframe first:

// Finds the button in any frame on the page.
await page.frameLocator().getByRole('button').click();

The rest of the locator resolves inside a single frame, just like a regular locator, and an error is thrown when it
matches elements in several frames.

👁️ Visible-only locators

New locator.visible() returns a locator that matches only visible elements. It is the recommended
replacement for the :visible CSS pseudo-class:

await page.locator('button').visible().click();

🧾 Step params and subtitles

Steps now carry structured data for reporters. Playwright API steps report the target locator and call arguments,
and test.step() accepts subtitle and params options for your own steps:

await test.step('Login', async () => {
  // ...
}, { subtitle: 'as admin', params: { user: 'admin' } });

Reporters receive them via testStep.subtitle and testStep.params. For Playwright API
steps, the subtitle is the locator or the navigation url — for example, Click with subtitle getByRole('button').
Both are rendered next to the step title in the trace viewer and the HTML report.

🖼️ Aria and screen snapshots in traces

The snapshots option of tracing.start() and the testOptions.trace fixture option now accept an
object selecting what to capture on every action:

// playwright.config.ts
export default defineConfig({
  use: {
    trace: {
      mode: 'on',
      snapshots: { dom: true, aria: true, screen: true }
    },
  },
});

With aria and screen snapshots recorded, the new Display Aria mode in the trace viewer shows the action screenshot
side by side with the aria snapshot, and hovering an aria node highlights it on the screenshot.

New APIs

Browser and Context

• httpCredentials now also accepts an array of credentials. The first entry matching the request origin is used, and entries without an origin match any request.
• New option opfs includes the origin private file system in the storage state, so it can be persisted and restored into later contexts.
• New events page.on('dialogclosed') and browserContext.on('dialogclosed') are emitted when a JavaScript dialog is accepted, dismissed or closed by the user.

Locators

• New locator.ariaSnapshotJSON() and page.ariaSnapshotJSON() return the aria snapshot as a JSON value instead of YAML markup, with mode, depth and boxes options.
• apiRequestContext.get() and other request methods accept a type argument that types the response json():

const response = await request.get<User>('/api/users/42');
const user = await response.json(); // typed as User

Test runner

• New standalone testOptions.reducedMotion, testOptions.forcedColors and testOptions.contrast options.
• New --add-reporter command line option appends a reporter on top of the ones configured in playwright.config, instead of replacing them like --reporter does.
• New omitTags option for the list, line, dot, github and junit reporters suppresses the tags that are automatically appended to test titles.

Command line

• npx playwright install --no-remove keeps the browsers of other Playwright installations instead of removing them.
• npx playwright codegen --http-credentials records against pages behind HTTP authentication.

Miscellaneous

• New built-in perfetto reporter writes a Trace Event Format file for the Perfetto UI or chrome://tracing, rendering the test run as a timeline with a lane per worker.
• The HTML report renders a duration waterfall next to test steps.

Announcements

• ⚠️ The experimental @playwright/experimental-ct-react, @playwright/experimental-ct-react17 and @playwright/experimental-ct-vue packages will no longer be updated. Follow the migration guide to move to the stories model introduced in 1.62. Story ids passed to fixtures.mount() can now be typed through the generated Stories registry.
• ⚠️ Ubuntu 20.04 is not supported anymore.
• 🐧 On Linux arm64, Playwright now downloads the Chrome for Testing build of Chromium, the same build used on all other platforms.

Browser Versions

• Chromium 153.0.8010.12
• Mozilla Firefox 155.0
• WebKit 26.6

This version was also tested against the following stable channels:

• Google Chrome 153
• Microsoft Edge 153

v1.62.1

Compare Source

Bug Fixes

• #​41989 [Regression]: tsconfig "extends" bare specifier isn't resolved via node_modules walk-up like tsc (fatal since 1.62)
• #​41998 [Regression]: directory-form tsconfig project references ("path": "../pkg") fail to resolve (fatal since 1.62)
• #​41985 Accessibility snapshot drops button name when text is nested inside spans with aria-hidden SVG
• #​42000 [Regression]: page.evaluate() arg of a branded primitive type (string & { brand }) no longer type-checks since 1.62
• #​42013 [BUG]Image-type actionable elements are not presented in the snapshot.

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand.
The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried.
The default 'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end, one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

• New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

• New apiResponse.timing() returns resource timing information for an API response.

Evaluation

• New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
• page.evaluate() and related methods now accept functions as evaluate arguments.
• page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

• Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

• The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

v1.61.1

Compare Source

Bug Fixes

• #​41365 [Bug]: Expect.Extend matcher with same name as default matcher in same expect instance overrides default matchers implementation to custom matcher
• #​41351 [Bug]: Playwright UI mode: apiRequestContext._wrapApiCall reports unexpected number of bytes (same test passes in headed mode)
• #​41360 [Bug]: Trace viewer: message times in websockets are downscaled by 1000
• #​41311 [Bug]: [Regression]: Sync loader throws "context.conditions?.includes is not a function" on Node 22.15
• #​41371 [Regression]: Sync ESM loader (registerHooks) fails to resolve extensionless .ts subpath imports across pnpm workspace symlinks

v1.61.0

Compare Source

🔑 WebAuthn passkeys

New Credentials virtual authenticator, available via browserContext.credentials, lets tests register passkeys and answer navigator.credentials.create() / navigator.credentials.get() ceremonies in the page — no real hardware key required, works in all browsers:

const context = await browser.newContext();

// Seed a passkey your backend provisioned for a test user.
await context.credentials.create('example.com', {
  id: credentialId,
  userHandle,
  privateKey,
  publicKey,
});
await context.credentials.install();

const page = await context.newPage();
await page.goto('https://example.com/login');
// The page's navigator.credentials.get() is answered with the seeded passkey.

You can also let the app register a passkey once in a setup test, read it back with credentials.get(), and seed it into later tests — see Credentials for details.

🗃️ Web Storage

New WebStorage API, available via page.localStorage and page.sessionStorage, reads and writes the page's storage for the current origin:

await page.localStorage.setItem('token', 'abc');
const token = await page.localStorage.getItem('token');
const items = await page.sessionStorage.items();

New APIs

Network

• apiResponse.securityDetails() and apiResponse.serverAddr() mirror the browser-side response.securityDetails() and response.serverAddr().

Browser and Screencast

• New option artifactsDir in browserType.connectOverCDP() controls where artifacts such as traces and downloads are stored when attached to an existing browser.
• New option cursor in screencast.showActions() controls the cursor decoration rendered for pointer actions.
• The onFrame callback in screencast.start() now receives a timestamp of when the frame was presented by the browser.

Test runner

• The testOptions.video option now supports the same set of modes as trace: new 'on-all-retries', 'retain-on-first-failure' and 'retain-on-failure-and-retries' values. See the video modes table for which runs are recorded and kept in each mode.
• Supported expect.soft.poll(...).
• New fullConfig.argv — a snapshot of process.argv from the runner process, handy for reading custom arguments passed after the -- separator.
• New fullConfig.failOnFlakyTests mirrors the config option, so reporters can explain why a flaky run failed.
• testInfo.errors now lists each sub-error of an AggregateError as a separate entry.
• New -G command line shorthand for --grep-invert.

🛠️ Other improvements

• Playwright now supports Ubuntu 26.04.
• HAR and trace recordings now include WebSocket requests.

Browser Versions

• Chromium 149.0.7827.55
• Mozilla Firefox 151.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 149
• Microsoft Edge 149

tailwindlabs/tailwindcss (@​tailwindcss/vite)

v4.3.3

Compare Source

Fixed

• Support --watch --poll[=ms] in @tailwindcss/cli when filesystem events are unreliable or unavailable (#​20297)
• Canonicalization: match arbitrary hex colors against theme colors case-insensitively (e.g. bg-[#fff] and bg-[#FFF] → bg-white) (#​20298)
• Prevent Preflight from overriding Firefox's native iframe:focus-visible outline styles (#​20292)
• Ensure theme('colors.foo') in JS plugins resolves correctly when both --color-foo and --color-foo-bar exist (#​20299)
• Ensure fractional opacity modifiers work with named shadow sizes like shadow-sm/12.5, text-shadow-sm/12.5, drop-shadow-sm/12.5, and inset-shadow-sm/12.5 (#​20302)
• Parse selectors like [data-foo]div as two selectors instead of one (#​20303)
• Ensure @tailwindcss/postcss rebuilds when a preprocessor like Sass changes the input CSS without changing the input file on disk (#​20310)
• Ensure CSS nesting is handled even when Lightning CSS isn't run, such as in @tailwindcss/browser and Tailwind Play (#​20124)
• Prevent achromatic theme colors from shifting hue when mixed in polar color spaces like oklch (#​20314)
• Ensure --spacing(0) is optimized to 0px instead of 0 so it remains a <length> when used in calc(…) (#​20319)
• Load @parcel/watcher only when needed in @tailwindcss/cli --watch mode, so one-off builds and --watch --poll work when @parcel/watcher can't be loaded (#​20325)
• Use explicit platform fonts instead of system-ui and ui-sans-serif so CJK text respects the page's lang attribute on Windows (#​20318)
• Prevent @tailwindcss/upgrade from rewriting ignored files when run from a subdirectory (#​20329)
• Ensure earlier @source rules pointing to nested files are scanned when later @source rules point to files in parent folders (#​20335)
• Prevent @tailwindcss/vite from triggering full page reloads when scanned files are processed by Vite but haven't been loaded as modules yet (#​20336)

v4.3.2

Compare Source

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#​20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#​20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#​20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#​20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#​20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#​20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#​20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#​20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#​20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#​20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#​20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#​20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#​20289)

v4.3.1

Compare Source

Added

• Add --silent option to suppress output in @tailwindcss/cli (#​20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#​20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#​20052)
• Allow @apply to be used with CSS mixins (#​19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#​20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#​20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#​20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#​20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#​20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#​20130)
• Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#​20137)
• Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#​20139)
• Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#​20198)
• Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#​19588)
• Allow @variant to be used inside addBase (#​19480)
• Ensure @source globs with symlinks are preserved (#​20203)
• Ensure later @source rules can re-include files excluded by earlier @source not rules (#​20203)
• Upgrade: don't migrate empty class rules to invalid @utility rules (#​20205)
• Ensure transitions between inset-shadow-none and other inset shadows work correctly (#​20208)
• Ensure explicitly referenced @source directories are scanned even when ignored by git (#​20214)
• Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#​20217)
• Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#​20221)
• Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#​20228)

Changed

• Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#​20196)
• Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#​20196)

vitejs/vite-plugin-vue (@​vitejs/plugin-vue)

v6.0.9

Bug Fixes

• deps: update all non-major dependencies (#​812) (b2b559d)
• plugin-vue: initialize compiler correctly (#​475) (127b03f)
• plugin-vue: transpile TS in templates with empty script block (#​838) (189148e)

Miscellaneous Chores

• deps: update dependency obug to v3 (#​846) (3180192)

v6.0.8

Features

• plugin-vue: add forced vapor mode option (#​766) (d59c3c0)

Bug Fixes

• deps: update all non-major dependencies (#​781) (d369e5a)

vitest-dev/vitest (@​vitest/coverage-v8)

v4.1.11

Compare Source

   🐞 Bug Fixes

• Revive global concurrency limit for test lifecycle [backport to v4]  -  by @​sheremet-va and @​hi-ogawa in #​10992 (5146d)
• browser:
  • Encode iframeId in tester iframe URL [backport to v4]  -  by @​sheremet-va, Pduhard and Claude Opus 4.8 in #​10955 (10b2c)
  • Trigger playwright/chromium gc on lower disk availability [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode in #​10951 (9851d)
• mocker:
  • Restrict redirect mocks to the fs allowlist [backport to v4]  -  by @​sheremet-va in #​10974 (fe5a1)

    View changes on GitHub

v4.1.10

Compare Source

   🐞 Bug Fixes

• browser: Check fs access in builtin commands [backport to v4]  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (claude-opus-4-8) in #​10680 (5c18d)
• vm: Fix external module resolve error with deps optimizer query for encoded URI [backport to v4]  -  by @​SveLil and @​hi-ogawa in #​10661 (bae52)

    View changes on GitHub

v4.1.9

Compare Source

🐞 Bug Fixes

• Fix importOriginal with optimizer and query import [backport to v4] - by Hiroshi Ogawa, David Harris, Codexand Vladimir in #​10546 (a5180)
• browser:
  • Wait for orchestrator readiness before resolving browser sessions [backport to v4] - by Vladimir and Séamus O'Connor in #​10555 (7fb29)
  • Wait for iframe tester readiness before preparing [backport to v4] - by Vladimir and Séamus O'Connor in #​10497 and #​10556 (fbc62)
• mocker:
  • Hoist vi.mock() for vite-plus/test imports [backport to v4] - by Hiroshi Ogawa, LongYinan, Claude Opus 4.8 and Vladimir in #​10548 (2c955)
• pool:
  • Prevent test run hang on worker crash [backport to v4] - by Ari Perkkiö and Jattioui Ismail in #​10543 and #​10564 (934b0)

View changes on GitHub

vuejs/test-utils (@​vue/test-utils)

v2.5.1

Compare Source

What's Changed

• fix: generic SFC findComponent types by @​simonyang08 in #​2934
• fix: share config across builds by @​cexbrayat in #​2937

New Contributors

• @​simonyang08 made their first contribution in #​2934

Full Changelog: vuejs/test-utils@v2.5.0...v2.5.1

v2.5.0

Compare Source

⚠️ Breaking change: Vue Test Utils no longer supports class components. See #​2904.

What's Changed

• fix: keep re-rendering root component after another wrapper is mounted by @​lazerg in #​2890
• fix: correct summary element behavior by @​nn-morishita in #​2806
• fix: clear emitted event history for child components on unmount by @​ebiryu in #​2898
• chore!: drop class component support by @​cexbrayat in #​2904
• fix: expose defineExpose bindings on findComponent vm by @​adamberecz in #​2927

New Contributors

• @​MetRonnie made their first contribution in #​2885
• @​lazerg made their first contribution in #​2890
• @​bartlomieju made their first contribution in #​2892
• @​nn-morishita made their first contribution in #​2806
• @​ebiryu made their first contribution in #​2898
• @​chiaraani made their first contribution in #​2916
• @​souserge made their first contribution in #​2695
• @​adamberecz made their first contribution in #​2927

Full Changelog: vuejs/test-utils@v2.4.11...v2.5.0

v2.4.11

Compare Source

compare changes

🩹 Fixes

• Drop legacy Mutation Event listener entries (#​2844)
• Handle setData() correctly for components using both setup() and data() (#​2846)
• Export GlobalMountOptions type (#​2851)
• Set spec-compliant event.code on keydown/keyup (#​2850)

❤️ Contributors

• Cédric Exbrayat (@​cexbrayat)
• Renato de Leão (@​renatodeleao)
• Matt Van Horn (@​mvanhorn)
• Carsten Brachem (@​cbrachem)
• Ahmad Hanan (@​AhmadHannan037)
• Paul Cochrane (@​paultcochrane)
• Arpit Jain (@​arpitjain099)

evilmartians/lefthook (lefthook)

v2.1.17

Compare Source

Changelog

• 8d8073d fix: diff push files against the merge base with the default branch (#​1565)
• c12bccd fix: don't hash submodules when checking fail_on_changes (#​1566)
• 03225ef refactor: naming of helpers (#​1568)
• 66746ac refactor: working with git (#​1564)

v2.1.16

Compare Source

• fix: test staging fixed files with partially staged by @​mrexox
• fix: preserve unrelated unstaged changes on conflict (#​1483) by @​Sakshamm-Goyal
• deps: bump mod and text deps to resolve CVEs (#​1560) by @​devindavies
• ci: refactor publishing scripts (#​1559) by @​mrexox

v2.1.15

Compare Source

• fix: do not pipe stdin into post-checkout git-lfs hook (#​1523) by @​rwinkelman
• fix: remove color blending (#​1558) by @​mrexox
• fix: resolve push-files fallback against the remote-tracking ref (#​1485) by @​hamodywe
• test: regression for valid fish shell completion output (#​1527) by @​rwinkelman
• fix: sanitize slashes in remote ref when building the checkout dir name (#​1486) by @​hamodywe
• fix: quote paths in the generated hook shim (#​1509) by @​addielaruee
• feat: propagate forced colors to hook commands via CLICOLOR_FORCE (#​1547) by @​Yash121l

v2.1.14

Compare Source

• fix: error when --job/--command matches nothing (#​1512) by @​nityanand123gupta
• fix: disable tty things when stdout is not TTY (#​1545) by @​mrexox
• docs: document files inheritance for grouped jobs (#​1536) by @​chiliec
• fix: force colors when colors are explicitly enabled (#​1538) by @​Yash121l
• fix: resolve file_types paths from the repo root (#​1537) by @​Yash121l
• fix: don't force-install hooks from the npm postinstall (#​1510) by @​hamodywe
• docs: quote template run examples (#​1472) by @​Guflly

v2.1.12

Compare Source

• fix: fail the hook when staging fixed files errors (#​1484) by @​teddytennant
• fix: LEFTHOOK_OUTPUT precedence (#​1506) by @​Yuki9814
• ci: fix npm publishing by bumping Node to 24 (#​1508) by @​mariokresic

v2.1.10

Compare Source

• deps: July 2026 (#​1463) by @​mrexox
• feat: AI coding agents integration (#​1448) by @​viralpraxis
• docs: fix language (#​1453) by @​pflanze
• fix: make test suite stable when NO_COLOR is set (#​1449) by @​viralpraxis
• deps: June 2026 (#​1447) by @​mrexox
• deps: migrate shellescape to al.essio.dev/pkg/shellescape (#​1443) by @​maguowei
• docs: upgrade docmd (#​1442) by @​mrexox
• docs: use single quotes in example to handle filepaths with $ by @​mrexox

DavidAnson/markdownlint-cli2 (markdownlint-cli2)

[v0.23.3](https://redirect.github.com/DavidAnson/markdownlint-cli2/blob/HEAD/C

❗ Important

✂ PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone America/Havana)

• Branch creation
  • At 05:00 PM through 11:59 PM and 12:00 AM through 06:59 AM, Monday through Friday (* 17-23,0-6 * * 1-5)
  • Only on Sunday and Saturday (* * * * 0,6)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: 6f886d32-ef71-405b-a2bd-e71671202177

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	npm/​@​iconify-json/​simple-icons@​1.2.98 ⏵ 1.2.99				+1
	npm/​@​vitest/​coverage-v8@​4.1.8 ⏵ 4.1.11
	npm/​vite@​8.0.16 ⏵ 8.3.2			+1	+1
	npm/​tailwindcss@​4.3.0 ⏵ 4.3.3	+1		+1
	npm/​@​tailwindcss/​vite@​4.3.0 ⏵ 4.3.3	+1		+1
	npm/​@​vitejs/​plugin-vue@​6.0.7 ⏵ 6.0.9	+1		+1
	npm/​markdownlint-cli2@​0.22.1 ⏵ 0.23.3			+1
	npm/​vue-tsc@​3.3.3 ⏵ 3.3.12
	npm/​lefthook@​2.1.9 ⏵ 2.1.17	+1		+1	+1
	npm/​reka-ui@​2.10.5 ⏵ 2.11.0			+1
	npm/​@​vue/​test-utils@​2.4.10 ⏵ 2.5.1	+1		+1	+2
	npm/​@​playwright/​test@​1.60.0 ⏵ 1.63.0

View full report

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!