chore(deps): update all non-major dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence	Type	Update
@changesets/cli (source)	2.31.0 → 2.31.1			dependencies	patch
@commitlint/cli (source)	21.0.2 → 21.2.1			dependencies	minor
@commitlint/config-conventional (source)	21.0.2 → 21.2.0			dependencies	minor
@internationalized/date (source)	3.12.2 → 3.12.3			dependencies	patch
@internationalized/date (source)	3.12.2 → 3.12.3			devDependencies	patch
@next/eslint-plugin-next (source)	16.2.9 → 16.3.0			devDependencies	minor
@pandacss/dev (source)	1.11.5 → 1.12.0			devDependencies	minor
@playwright/test (source)	1.61.1 → 1.62.1			dependencies	minor
@sveltejs/vite-plugin-svelte (source)	7.1.2 → 7.3.0			devDependencies	minor
@swc/core (source)	1.15.41 → 1.15.47			dependencies	patch
@tanstack/react-virtual (source)	3.14.3 → 3.14.9			dependencies	patch
@types/node (source)	25.9.4 → 25.9.5			devDependencies	patch
@types/node (source)	25.9.4 → 25.9.5			dependencies	patch
@types/react (source)	19.2.17 → 19.2.18			devDependencies	patch
@types/react-dom (source)	19.2.3 → 19.2.4			devDependencies	patch
@vitejs/plugin-react (source)	6.0.4 → 6.0.5			devDependencies	patch
color2k	2.0.3 → 2.0.4			dependencies	patch
commitlint (source)	21.0.2 → 21.2.1			dependencies	minor
eslint (source)	10.5.0 → 10.8.1			devDependencies	minor
eslint (source)	10.5.0 → 10.8.1			dependencies	minor
eslint-config-next (source)	16.2.9 → 16.3.0			devDependencies	minor
globals	17.7.0 → 17.9.0			dependencies	minor
lint-staged	17.0.8 → 17.3.0			dependencies	minor
lucide-react (source)	1.21.0 → 1.31.0			dependencies	minor
next (source)	16.2.9 → 16.3.0			dependencies	minor
next-seo	7.2.0 → 7.3.0			dependencies	minor
node (source)	24.16.0 → 24.19.0				minor
pnpm (source)	11.8.0 → 11.21.0			packageManager	minor
preact (source)	10.29.2 → 10.29.8			devDependencies	patch
prettier (source)	3.8.4 → 3.9.6			devDependencies	minor
prettier (source)	3.8.4 → 3.9.6			dependencies	minor
react (source)	19.2.7 → 19.2.8			dependencies	patch
react (source)	19.2.7 → 19.2.8			devDependencies	patch
react-dom (source)	19.2.7 → 19.2.8			dependencies	patch
react-dom (source)	19.2.7 → 19.2.8			devDependencies	patch
react-icons	5.6.0 → 5.7.0			dependencies	minor
solid-js (source)	1.9.13 → 1.9.14			devDependencies	patch
svelte (source)	5.56.3 → 5.56.8			devDependencies	patch
tsx (source)	4.22.4 → 4.23.11			dependencies	minor
typescript-eslint (source)	8.65.0 → 8.66.0			dependencies	minor
vite (source)	8.0.16 → 8.2.1			devDependencies	minor
vite (source)	8.0.16 → 8.2.1			dependencies	minor
vite-plugin-solid	2.11.13 → 2.11.14			devDependencies	patch
vitest (source)	4.1.9 → 4.1.10			devDependencies	patch
vitest (source)	4.1.9 → 4.1.10			dependencies	patch
vue (source)	3.5.38 → 3.5.41			devDependencies	patch

---

Release Notes

changesets/changesets (@​changesets/cli)

v2.31.1

Compare Source

Patch Changes

• #​2159 15cf592 Thanks @​ingvaldlorentzen! - Fixed already-published version detection with npm 12, which always wraps successful npm info --json output in an array. The unwrapped output made changeset publish treat every package as unpublished and fail attempting to republish existing versions.

conventional-changelog/commitlint (@​commitlint/cli)

v21.2.1

Compare Source

Note: Version bump only for package @​commitlint/cli

v21.2.0

Compare Source

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#​4859) (fdb566f)

v21.1.0

Compare Source

Features

• cli: add --default-config flag to lint without a config file (#​4805) (7af27ba), closes #​3662

21.0.2 (2026-05-29)

Bug Fixes

• disallow same commit hash for --from and --to (#​4773) (121005e)

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/cli

conventional-changelog/commitlint (@​commitlint/config-conventional)

v21.2.0

Compare Source

Features

• resolve-extends: resolve pure-ESM presets (conventional-changelog v7/v9/v10) (#​4859) (fdb566f)

v21.1.0

Compare Source

Note: Version bump only for package @​commitlint/config-conventional

21.0.2 (2026-05-29)

Note: Version bump only for package @​commitlint/config-conventional

21.0.1 (2026-05-12)

Note: Version bump only for package @​commitlint/config-conventional

adobe/react-spectrum (@​internationalized/date)

v3.12.3

Compare Source

vercel/next.js (@​next/eslint-plugin-next)

v16.3.0

Compare Source

v16.2.12

Compare Source

v16.2.11

Compare Source

This release contains security fixes for the following advisories:

High:

• Denial of Service in App Router using Server Actions
• Middleware / Proxy bypass in App Router applications using Turbopack and single locale
• Server-Side Request Forgery in rewrites via attacker-controlled destination hostname
• Server-Side Request Forgery in Server Actions on custom servers

Moderate:

• Cache confusion of response bodies for requests with bodies
• Cache confusion of response bodies for requests with bodies containing invalid UTF-8 byte sequences
• Denial of Service in the Image Optimization API using SVGs
• Unauthenticated disclosure of internal Server Function endpoints
• Unbounded Server Action payload in Edge runtime

v16.2.10

Compare Source

Contains no changes except publishing @next/swc-wasm-web which was accidentally not published since 16.2.4.

chakra-ui/panda (@​pandacss/dev)

v1.12.0

Compare Source

Minor Changes

• 76a997b: Move MCP out of @pandacss/dev so installs no longer pull the MCP SDK and Hono, which kept triggering
  security vulnerability reports. Use npx -y @pandacss/mcp instead. panda mcp / panda init-mcp now error with a
  migration message.

Patch Changes

• 2654bb4: updates outdated @clack/prompts dependency
• Updated dependencies [0ad3371]
• Updated dependencies [76a997b]
  • @​pandacss/node@​1.12.0
  • @​pandacss/shared@​1.12.0
  • @​pandacss/postcss@​1.12.0
  • @​pandacss/config@​1.12.0
  • @​pandacss/token-dictionary@​1.12.0
  • @​pandacss/types@​1.12.0
  • @​pandacss/logger@​1.12.0
  • @​pandacss/preset-base@​1.12.0
  • @​pandacss/preset-panda@​1.12.0

microsoft/playwright (@​playwright/test)

v1.62.1

Compare Source

v1.62.0

Compare Source

🧱 New component testing model

Component testing moves to a stories and galleries model.
A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a

gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates
to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) /
unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an
AbortSignal, letting you
cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);

await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot()
can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');

// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and locator.screenshot() also accept webp as a type,
where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before
reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded,
fixed, or failing through a TestRun object:

class MyReporter {
  async preprocess({ config, suite, testRun }) {
    for (const test of suite.allTests()) {
      if (shouldSkip(test))
        testRun.skip(test);
    }
  }
}

🔁 Isolated retries

New testConfig.retryStrategy controls when failed tests are retried. The default
'immediate' retries as soon as a worker is free; 'isolated' runs all retries at the end,
one by one in a single worker, to minimize interference with the rest of the suite:

// playwright.config.ts
export default defineConfig({
  retries: 2,
  retryStrategy: 'isolated',
});

New APIs

Browser and Context

• New option credentials includes the context's virtual WebAuthn Credentials (passkeys) in the storage state, so they can be persisted and re-seeded into later contexts.

Actions

• New scroll option ("auto" | "none") on actions to opt out of Playwright's automatic scroll-into-view.

Network

• New apiResponse.timing() returns resource timing information for an API response.

Evaluation

• New locator.waitForFunction() waits until a function — called with the matching element — returns a truthy value.
• page.evaluate() and related methods now accept functions as evaluate arguments.
• page.addInitScript() / browserContext.addInitScript() now accept functions as init-script arguments.

Command line & MCP

• Playwright now bundles the Playwright MCP server and playwright-cli, runnable via npx playwright mcp and npx playwright cli.

Reporters

• The HTML report's Merge files grouping — previously only a UI toggle — can now be enabled from the config with the new mergeFiles reporter option:

// playwright.config.ts
export default defineConfig({
  reporter: [['html', { mergeFiles: true }]],
});

Announcements

• ⚠️ Debian 11 is not supported anymore.

Browser Versions

• Chromium 151.0.7922.34
• Mozilla Firefox 153.0
• WebKit 26.5

This version was also tested against the following stable channels:

• Google Chrome 151
• Microsoft Edge 151

sveltejs/vite-plugin-svelte (@​sveltejs/vite-plugin-svelte)

v7.3.0

Compare Source

Minor Changes

• feat: pass environment to dynamicCompileOptions (#​1386)

Patch Changes

• fix: don't log inline config when encountering unexpected options (#​1376)

v7.2.0

Compare Source

Minor Changes

• feat(inspector): add a context menu with current component stack (#​1370)

v7.1.4

Compare Source

Patch Changes

• fix: enforce ltr styles for inspector (#​1324)

v7.1.3

Compare Source

Patch Changes

• fix: ensure the inspector is injected into the client correctly for Vite+ projects (#​1355)

swc-project/swc (@​swc/core)

v1.15.47

Compare Source

Bug Fixes

• (es) Preserve numeric property key identity (#​12050) (46900a3)

• (es/ast) Support hashing non-finite numbers (#​12043) (f4b85a6)

• (es/codegen) Emit non-finite numeric literals (#​12047) (883abc4)

• (es/decorators) Avoid class state leakage for nested undecorated classes (#​12076) (4c9d277)

• (es/minifier) Apply ToInt32 when folding bitwise NOT (#​12058) (550e2f7)

• (es/minifier) Avoid inexact number radix folding (#​12057) (506a0ea)

• (es/minifier) Preserve invalid Array lengths (#​12056) (3ce9e16)

• (es/minifier) Preserve non-canonical arguments access (#​12052) (850230b)

• (es/minifier) Apply ToUint16 in fromCharCode (#​12055) (9ae7b92)

• (es/minifier) Index strings by UTF-16 code unit (#​12054) (bc263d2)

• (es/minifier) Use numeric literals for non-finite values (#​12048) (b830786)

• (es/minifier) Preserve top-level declarations referenced only by direct eval (#​12029) (ad0e3b4)

• (es/optimization) Preserve JSON numeric values (#​12051) (667af8c)

• (es/transforms) Use numeric literals for non-finite enum values (#​12049) (1e3ed5c)

• (es/typescript) Evaluate cooked enum templates (#​12059) (49d0b0f)

• (html/minifier) Preserve JSON script boundaries (#​12080) (e1877b4)

• (testing) Check ignored fixtures relative to crate root (#​12073) (da858b4)

• (ts/fast-strip) Preserve ASI before interpolated templates (#​12040) (54467fe)

• (ts/fast-strip) Preserve UTF-16 source positions (#​12067) (ac4bfc9)

Features

• (es/minifier) Expand support for trivial spreads (#​12068) (aa49e36)

• (es/react-compiler) Expose reactCompiler.environment.enableFunctionOutlining (#​12030) (52b78aa)

Performance

• (es/renamer) Skip identity rename mappings on apply (#​12041) (0f9ff15)

v1.15.46

Compare Source

Bug Fixes

• (deps) Update crossbeam-epoch to 0.9.20 (#​12004) (fababa1)

• (es/fixer) Normalize for-head ident patterns (#​11968) (af681bc)

• (es/fixer) Preserve parens around PURE-annotated receivers (#​12022) (73d8941)

• (es/hygiene) Ignore eval in default hygiene pass (#​12003) (dd43ad6)

• (es/minifier) Eliminate unused classes with cyclic references (#​11963) (63a94b9)

• (es/minifier) Preserve switch fallthrough termination (#​11971) (a5d19ae)

• (es/minifier) Check last case (#​11972) (060c7ac)

• (es/minifier) Disable IIFE invoke when there's eval (#​11984) (eabe4be)

• (es/minifier) Invoke IIFE when has eval (#​11987) (457df11)

• (es/minifier) Make Infect Collect collect every used ident (#​11998) (fb9ebee)

• (es/minifier) Measure number length precisely (#​12026) (54d139a)

• (es/module) Rewrite .tsx imports to .js unless JSX is preserved (#​11995) (c341d9c)

• (es/module) Rewrite SystemJS transform (#​11996) (2f47530)

• (es/modules) Resolve relative symlinked inputs from cwd (#​11883) (01e857d)

• (es/react) Emit jsxdev source for fragments (#​11993) (a70ce24)

• (es/react-compiler) Correct catch and parameter scope resolution (#​11985) (3867e57)

• (react-compiler) Remove React-like prefilter (#​12007) (ab66869)

• (ts/fast-strip) Handle generic arrow line breaks (#​12034) (3d82701)

Documentation

• (agents) Document minifier assumptions (#​11966) (58df612)

Features

• (bindings) Add lint / lintSync API to @swc/react-compiler (#​11965) (ab4ce67)

• (es/minifier) Remove unused param for new Function or Class Expr (#​12017) (be56e09)

• (es/minifier) Remove unused param for new expr (#​12027) (661067c)

• (wasm) Add @​swc/nodejs-support-wasm (#​11975) (b617562)

Refactor

• (es/helpers) Generate inline helpers from canonical ESM sources (#​12006) (f36e4b6)

• (es/helpers) Remove unused jsx helper (#​12009) (ccbc906)

• (es/lexer) Remove smartstring dependency (#​12013) (d6833cc)

• (es/minifier) Remove ProgramData.top (#​12031) (a72571f)

• (es/module) Align module transform records with spec terms (#​11992) (f680df5)

• (es/module) Introduce source module lowering pipeline (#​11999) (9609b7f)

• Remove direct rkyv dependencies (#​12010) (5761a2b)

Testing

• (react-compiler) Add build-pass fixtures for wrapped assignment targets (#​11967) (58d9b53)

Build

• Remove vergen dependency (#​11976) (26d8a28)

Ci

• Allow publish milestone PR updates (#​11960) (885d3e2)

• Allow memmap2 advisory (#​11961) (0be5872)

• Update rust-toolchain action pin (#​12021) (78b41b5)

• Use Node.js 24 by default (#​12035) (d658d08)

• Update rust-toolchain action pin (#​12036) (d1a1e23)

• Use Node.js 24 for wasm publishing (#​12038) (516bf3c)

v1.15.43

Compare Source

Bug Fixes

• (es/es2022) Correct scope for private property brand checks (#​11953) (fb5afa2)

• (es/minifier) Preserve cooked when concatenating template literals (#​11939) (a7244a6)

• (es/minifier) Gate Number(x) -> +x on unsafe flag (#​11944) (#​11949) (6176019)

• (es/parser) Parse Flow bare renders types (#​11929) (a71c8eb)

• (es/parser) Allow no-default builds (#​11956) (baab240)

• (es/react-compiler) Skip TypeScript this pseudo-params in scope collector (#​11940) (9066c43)

• (es/react-compiler) Scope ClassStaticBlock and TsModuleBlock as var boundaries (#​11943) (1ee74a0)

• (react-compiler) Avoid reporting non-fatal success errors as diagnostics (#​11951) (cb4cb23)

• (react-compiler) React compiler AST conversion for wrapped assignment targets (#​11952) (fc9b453)

• (react-compiler) Disable parser default features (#​11957) (75ddb28)

Documentation

• Document untrusted input security scope (#​11937) (677305b)

Features

• (es/react-compiler) Add React Compiler (#​11917) (b182fbd)

• (swc) Gate react compiler re-export (#​11941) (dcc0f2d)

Miscellaneous Tasks

• (es/react-compiler) Update forked react compiler to 0.2.0 (#​11946) (6fbe188)

Refactor

• (es/react-compiler) Preserve TS metadata during AST roundtrip (#​11950) (9c4dec3)

• Remove production tracing hooks (#​11945) (0dffdc4)

Details

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (in timezone UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[changeset-bot]

⚠️ No Changeset found

Latest commit: f10f93a

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
zag-nextjs	Ready	Preview	Aug 9, 2026 8:01pm
zag-solid	Ready	Preview	Aug 9, 2026 8:01pm
zag-svelte	Ready	Preview	Aug 9, 2026 8:01pm
zag-vue	Ready	Preview	Aug 9, 2026 8:01pm
zag-website	Ready	Preview	Aug 9, 2026 8:01pm