chore(deps): bump the dev-dependencies group across 1 directory with 5 updates #544

dependabot · 2026-01-28T18:38:18Z

Bumps the dev-dependencies group with 5 updates in the / directory:

Package	From	To
sort-package-json	`3.1.0`	`3.6.1`
esbuild	`0.25.12`	`0.27.2`
@testing-library/react	`16.3.0`	`16.3.2`
@playwright/test	`1.52.0`	`1.58.0`
@types/node	`25.0.10`	`25.1.0`

Updates sort-package-json from 3.1.0 to 3.6.1

Release notes

Sourced from sort-package-json's releases.

v3.6.1

3.6.1 (2026-01-25)

Bug Fixes

stop forcing exports "types" to be first (#398) (15e1140)

v3.6.0

3.6.0 (2025-12-14)

Features

sort dependencies according to detected package manager, support devEngines field (#382) (e3f2370)

v3.5.2

3.5.2 (2025-12-14)

Bug Fixes

handle colon-prefixed script names in sorter (#389) (0b528c2)

v3.5.1

3.5.1 (2025-12-08)

Bug Fixes

improve-scripts-sorting (#376) (e6052c4)

v3.5.0

3.5.0 (2025-11-26)

Features

sort types and default in exports field (#349) (7f22864)

v3.4.0

3.4.0 (2025-07-02)

Features

remove workspaces array sort (#373) (a038956)

v3.3.1

3.3.1 (2025-06-25)

... (truncated)

Commits

15e1140 fix: stop forcing exports "types" to be first (#398)
e3f2370 feat: sort dependencies according to detected package manager, support `devEn...
0b528c2 fix: handle colon-prefixed script names in sorter (#389)
e6052c4 fix: improve-scripts-sorting (#376)
f94ab01 refactor: simplify & dry (#385)
fe45870 ci: reintroduce GITHUB_TOKEN (#387)
4014ba1 ci: drop specified secrets, rely on implicit GH token (#386)
c5c791c ci: fix release workflow (#384)
d6a3a66 chore: use semver per-method import (#380)
c3bf18a chore: update dependencies, enable trust publishing (#381)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for sort-package-json since your current version.

Updates esbuild from 0.25.12 to 0.27.2

Release notes

Sourced from esbuild's releases.

v0.27.2
Allow import path specifiers starting with #/ (#4361)

Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

This change was contributed by @hybrist.
Automatically add the -webkit-mask prefix (#4357, #4358)

This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:
/* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}
This change was contributed by @BPJEnnova.
Additional minification of switch statements (#4176, #4359)

This release contains additional minification patterns for reducing switch statements. Here is an example:
// Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
// Old output (with --minify)
switch(x){case 0:foo();break;case 1:default:bar()}
// New output (with --minify)

... (truncated)

Changelog

Sourced from esbuild's changelog.

0.27.2
Allow import path specifiers starting with #/ (#4361)

Previously the specification for package.json disallowed import path specifiers starting with #/, but this restriction has recently been relaxed and support for it is being added across the JavaScript ecosystem. One use case is using it for a wildcard pattern such as mapping #/* to ./src/* (previously you had to use another character such as #_* instead, which was more confusing). There is some more context in nodejs/node#49182.

This change was contributed by @hybrist.
Automatically add the -webkit-mask prefix (#4357, #4358)

This release automatically adds the -webkit- vendor prefix for the mask CSS shorthand property:
/* Original code */
main {
  mask: url(x.png) center/5rem no-repeat
}
/* Old output (with --target=chrome110) */
main {
mask: url(x.png) center/5rem no-repeat;
}
/* New output (with --target=chrome110) */
main {
-webkit-mask: url(x.png) center/5rem no-repeat;
mask: url(x.png) center/5rem no-repeat;
}
This change was contributed by @BPJEnnova.
Additional minification of switch statements (#4176, #4359)

This release contains additional minification patterns for reducing switch statements. Here is an example:
// Original code
switch (x) {
  case 0:
    foo()
    break
  case 1:
  default:
    bar()
}
// Old output (with --minify)
switch(x){case 0:foo();break;case 1:default:bar()}

... (truncated)

Commits

cd83297 publish 0.27.2 to npm
2759721 additional tests for switch with break
fd2b4b3 update release notes
c8d93a7 fix #4357: -webkit- prefix for mask shorthand (#4358)
92ff12c compat table: update @types/node
a35eceb compat table: fix a type error with the new types
f598984 fix make compat-table to install dependencies
f7f6df0 release notes for #4361
6f8ec15 fix: allow subpath imports that start with #/ (#4361)
f7ae61f minify some switch statements to if-else statement
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for esbuild since your current version.

Updates @testing-library/react from 16.3.0 to 16.3.2

Release notes

Sourced from @testing-library/react's releases.

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

Update 'onCaughtError' type inference in 'RenderOptions' to work with React v19 (#1438) (f32bd1b)

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

Switch to trusted publishing (#1437) (a2d37ff)

Commits

f32bd1b fix: Update 'onCaughtError' type inference in 'RenderOptions' to work with Re...
a2d37ff fix: Switch to trusted publishing (#1437)
cd6a175 chore: fix action permissions (#1436)
22b8c28 chore: fix release (#1435)
d996673 chore: new release workflow (#1434)
205ce17 chore: fix typo in jest.config.js (#1427)
aba5740 [test] Fix tests for react@experimental (#1424)
590bc18 [test] Fix npm run typecheck (#1423)
1c931a6 chore(deps): use npm-run-all2 (#1411)
See full diff in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @testing-library/react since your current version.

Updates @playwright/test from 1.52.0 to 1.58.0

Release notes

Sourced from @playwright/test's releases.

v1.58.0

📣 Playwright CLI+SKILLs 📣

We are adding a new token-efficient CLI mode of operation to Playwright with the skills located at playwright-cli. This brings the long-awaited official SKILL-focused CLI mode to our story and makes it more coding agent-friendly.

It is the first snapshot with the essential command set (which is already larger than the original MCP!), but we expect it to grow rapidly. Unlike the token use, that one we expect to go down since snapshots are no longer forced into the LLM!

Timeline

If you're using merged reports, the HTML report Speedboard tab now shows the Timeline:

UI Mode and Trace Viewer Improvements

New 'system' theme option follows your OS dark/light mode preference

Search functionality (Cmd/Ctrl+F) is now available in code editors

Network details panel has been reorganized for better usability

JSON responses are now automatically formatted for readability

Thanks to @cpAdm for contributing these improvements!

Miscellaneous

browserType.connectOverCDP() now accepts an isLocal option. When set to true, it tells Playwright that it runs on the same host as the CDP server, enabling file system optimizations.

Breaking Changes ⚠️

Removed _react and _vue selectors. See locators guide for alternatives.

Removed :light selector engine suffix. Use standard CSS selectors instead.

Option devtools from browserType.launch() has been removed. Use args: ['--auto-open-devtools-for-tabs'] instead.

Removed macOS 13 support for WebKit. We recommend to upgrade your macOS version, or keep using an older Playwright version.

Browser Versions

Chromium 145.0.7632.6

Mozilla Firefox 146.0.1

WebKit 26.0

This version was also tested against the following stable channels:

Google Chrome 144

Microsoft Edge 144

v1.57.0

Speedboard

In HTML reporter, there's a new tab we call "Speedboard":

It shows you all your executed tests sorted by slowness, and can help you understand where your test suite is taking longer than expected. Take a look at yours - maybe you'll find some tests that are spending a longer time waiting than they should!

... (truncated)

Commits

961381e chore: mark 1.58.0 (#38921)
0c1b64c chore: hide stuff (#38882)
b1fd5d0 test: unflake some ui-mode tests (#38907)
faf317c chore: tune press/type via cli (#38898)
ba4b983 docs: add v1.58 release notes (#38879)
00fb7a9 chore: implement shard weights feedback (#38902)
42d4f18 test: unflake/skip/fix some tests (#38905)
42b9784 feat(dot): onTestPause + make --pause private (#38904)
428b557 fix(html): truncate step titles (#38884)
5959834 chore(list): onTestPaused (#38777)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by [GitHub Actions](https://www.npmjs.com/~GitHub Actions), a new releaser for @playwright/test since your current version.

Updates @types/node from 25.0.10 to 25.1.0

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
@dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
@dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
@dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
@dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

…5 updates Bumps the dev-dependencies group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [sort-package-json](https://github.com/keithamus/sort-package-json) | `3.1.0` | `3.6.1` | | [esbuild](https://github.com/evanw/esbuild) | `0.25.12` | `0.27.2` | | [@testing-library/react](https://github.com/testing-library/react-testing-library) | `16.3.0` | `16.3.2` | | [@playwright/test](https://github.com/microsoft/playwright) | `1.52.0` | `1.58.0` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `25.0.10` | `25.1.0` | Updates `sort-package-json` from 3.1.0 to 3.6.1 - [Release notes](https://github.com/keithamus/sort-package-json/releases) - [Commits](keithamus/sort-package-json@v3.1.0...v3.6.1) Updates `esbuild` from 0.25.12 to 0.27.2 - [Release notes](https://github.com/evanw/esbuild/releases) - [Changelog](https://github.com/evanw/esbuild/blob/main/CHANGELOG.md) - [Commits](evanw/esbuild@v0.25.12...v0.27.2) Updates `@testing-library/react` from 16.3.0 to 16.3.2 - [Release notes](https://github.com/testing-library/react-testing-library/releases) - [Changelog](https://github.com/testing-library/react-testing-library/blob/main/CHANGELOG.md) - [Commits](testing-library/react-testing-library@v16.3.0...v16.3.2) Updates `@playwright/test` from 1.52.0 to 1.58.0 - [Release notes](https://github.com/microsoft/playwright/releases) - [Commits](microsoft/playwright@v1.52.0...v1.58.0) Updates `@types/node` from 25.0.10 to 25.1.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: sort-package-json dependency-version: 3.6.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: esbuild dependency-version: 0.27.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@testing-library/react" dependency-version: 16.3.2 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: dev-dependencies - dependency-name: "@playwright/test" dependency-version: 1.58.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies - dependency-name: "@types/node" dependency-version: 25.1.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: dev-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>

socket-security · 2026-01-28T18:39:05Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Package	Supply Chain Security	Quality	Maintenance
esbuild@0.27.2
@testing-library/react@16.3.0 ⏵ 16.3.2
sort-package-json@3.1.0 ⏵ 3.6.1			⁺¹⁰
@playwright/test@1.52.0 ⏵ 1.58.0
@types/node@25.0.10 ⏵ 25.1.0	⁺¹	⁺²⁰	⁺⁵

View full report

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 28, 2026

dependabot bot requested a review from a team as a code owner January 28, 2026 18:38

dependabot bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels Jan 28, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): bump the dev-dependencies group across 1 directory with 5 updates #544

chore(deps): bump the dev-dependencies group across 1 directory with 5 updates #544

Uh oh!

dependabot bot commented on behalf of github Jan 28, 2026 •

edited

Loading

Uh oh!

socket-security bot commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

chore(deps): bump the dev-dependencies group across 1 directory with 5 updates #544

Are you sure you want to change the base?

chore(deps): bump the dev-dependencies group across 1 directory with 5 updates #544

Uh oh!

Conversation

dependabot bot commented on behalf of github Jan 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v3.6.1

3.6.1 (2026-01-25)

Bug Fixes

v3.6.0

3.6.0 (2025-12-14)

Features

v3.5.2

3.5.2 (2025-12-14)

Bug Fixes

v3.5.1

3.5.1 (2025-12-08)

Bug Fixes

v3.5.0

3.5.0 (2025-11-26)

Features

v3.4.0

3.4.0 (2025-07-02)

Features

v3.3.1

3.3.1 (2025-06-25)

v0.27.2

0.27.2

v16.3.2

16.3.2 (2026-01-19)

Bug Fixes

v16.3.1

16.3.1 (2025-12-15)

Bug Fixes

v1.58.0

📣 Playwright CLI+SKILLs 📣

Timeline

UI Mode and Trace Viewer Improvements

Miscellaneous

Breaking Changes ⚠️

Browser Versions

v1.57.0

Speedboard

Uh oh!

socket-security bot commented Jan 28, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot bot commented on behalf of github Jan 28, 2026 •

edited

Loading