chore(deps): bump the npm-deps group with 8 updates

[dependabot]

Bumps the npm-deps group with 8 updates:

Package	From	To
@better-auth/oauth-provider	1.6.24	1.6.25
@hono/node-server	2.0.11	2.0.12
hono	4.12.31	4.12.32
@playwright/test	1.61.1	1.62.0
eslint	10.7.0	10.8.0
fallow	3.8.0	3.10.0
globals	17.7.0	17.8.0
tap	21.7.4	21.7.5

Updates @better-auth/oauth-provider from 1.6.24 to 1.6.25

Release notes

Sourced from @​better-auth/oauth-provider's releases.

v1.6.25

better-auth

Bug Fixes

• Fixed Apple OAuth not sending the PKCE code challenge during authorization, causing token exchange failures (#10294)
• Fixed Google One Tap creating new users when sign-up was disabled on the Google provider (#10479)
• Fixed $fetch and $store not being exposed on the Solid client (#10444)
• Fixed internal adapter queries being routed to the wrong table when a built-in table's modelName was set to another table's schema key (e.g. user.modelName = "account").

For detailed changes, see CHANGELOG

Contributors

Thanks to everyone who contributed to this release:

@​birkskyum, @​jsj, @​krish-vachhani

Full changelog: v1.6.24...v1.6.25

Changelog

Sourced from @​better-auth/oauth-provider's changelog.

1.6.25

Patch Changes

• Updated dependencies [5124c34, 0ffd1fb, 7439359]:
  • better-auth@1.6.25
  • @​better-auth/core@​1.6.25

Commits

• 07a646e chore: release v1.6.25 (#10491)
• See full diff in compare view

Updates @hono/node-server from 2.0.11 to 2.0.12

Release notes

Sourced from @​hono/node-server's releases.

v2.0.12

What's Changed

• test: replace supertest by @​BlankParticle in honojs/node-server#379
• fix(response): copy headers when init is a foreign Response by @​yusukebe in honojs/node-server#382

Full Changelog: honojs/node-server@v2.0.11...v2.0.12

Commits

• a813b6c 2.0.12
• caf48ba fix(response): copy headers when init is a foreign Response (#382)
• 3b1dd68 test: replace supertest (#379)
• See full diff in compare view

Updates hono from 4.12.31 to 4.12.32

Release notes

Sourced from hono's releases.

v4.12.32

What's Changed

• ci: enable reports for type & bundle size check in honojs/hono#5148
• fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 in honojs/hono#5142
• fix(sse): emit empty id field to reset Last-Event-ID in honojs/hono#5138
• test(cloudflare-workers): add coverage for onClose, onError, send, and close in Cloudflare Workers websocket adapter in honojs/hono#5145
• fix: use Object.create(null) when parsing query, headers, and params in honojs/hono#5161
• fix(secure-headers): keep CSP callbacks scoped to their header in honojs/hono#5147

Full Changelog: honojs/hono@v4.12.31...v4.12.32

Commits

• 26d8e42 4.12.32
• 402eb3a fix(secure-headers): keep CSP callbacks scoped to their header (#5147)
• c85aead fix: use Object.create(null) when parsing query, headers, and params (#5161)
• a88c89d test(cloudflare-workers): add coverage for onClose, onError, send, and close ...
• 44f8843 fix(sse): emit empty id field to reset Last-Event-ID (#5138)
• e36f57d fix(aws-lambda): add jwt and lambda authorizer types for API Gateway v2 (#5142)
• bf8608c ci: enable reports for type & bundle size check (#5148)
• See full diff in compare view

Updates @playwright/test from 1.61.1 to 1.62.0

Release notes

Sourced from @​playwright/test's releases.

v1.62.0

🧱 New component testing model

Component testing moves to a stories and galleries model. A story wraps your component in one specific scenario — hard-coded props, mock data, providers — and a gallery page that you serve renders stories on demand. The new fixtures.mount() fixture navigates to the gallery, mounts a story by id, and returns a Locator scoped to the story's root element:

test('click should expand', async ({ mount }) => {
  const component = await mount('components/Expandable/Stateful');
  await component.getByRole('button').click();
  await expect(component.getByTestId('expanded')).toHaveValue('true');
});

Pass a story type as a template argument to type-check its props, and use update(props) / unmount() on the returned locator to re-render or tear down within a test.

🛑 Cancel operations with AbortSignal

Most operations and web-first assertions now accept a signal option that takes an AbortSignal, letting you cancel long-running actions, navigations, waits, and assertions:

const controller = new AbortController();
setTimeout(() => controller.abort(), 1000);
await page.getByRole('button', { name: 'Submit' }).click({ signal: controller.signal });
await expect(page.getByText('Done')).toBeVisible({ signal: controller.signal });

Providing a signal does not disable the default timeout; pass timeout: 0 to disable it.

🖼️ WebP screenshots

expect(page).toHaveScreenshot() and expect(locator).toHaveScreenshot() can now store snapshots in the WebP format — just give the snapshot a .webp name:

// Visual comparisons store the golden snapshot as lossless WebP.
await expect(page).toHaveScreenshot('homepage.webp');
// Standalone screenshots can trade quality for size with lossy WebP.
await page.screenshot({ path: 'homepage.webp', quality: 50 });

page.screenshot() and [locator.screenshot() (https://playwright.dev/docs/api/class-locator#locator-screenshot) also accept webp as a type, where quality 100 (the default) is lossless and lower values use lossy compression.

🧩 Custom test filtering with Reporter.preprocess()

New reporter.preprocess() hook runs after the configuration is resolved and before reporter.onBegin(), letting a reporter mark individual tests as skipped, excluded, fixed, or failing through a TestRun object:

</tr></table> 

... (truncated)

Commits

• e3950d9 chore: mark v1.62.0 (#41981)
• f07e0f7 cherry-pick(#41940): docs: release notes for v1.62 (#41967)
• 05a306c cherry-pick(#41964): Revert "feat(routeFromHar): add interceptAPIRequests opt...
• 2934858 fix: correct pending navigation log spacing (#41949)
• 4b0cc99 fix(test): unflake screencast backpressure test on slow macOS runner (#41951)
• bbbae6d test: fixme WebSocket locale test in Chromium 150 (#41944)
• 15c4f55 fix(mcp): identify downloads explicitly (#41933)
• f5fa967 fix(network): request.postData() returns null for empty string body override ...
• 0edafe4 fix(mcp): launch the Chrome profile that has the extension installed (#41939)
• 244a1ff feat(firefox): roll to r1538 (#41938)
• Additional commits viewable in compare view

Updates eslint from 10.7.0 to 10.8.0

Release notes

Sourced from eslint's releases.

v10.8.0

Features

• 2fee9bb feat: export ConfigObject from eslint/config (#21082) (sethamus)

Bug Fixes

• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129) (Francesco Trotta)
• 9091071 fix: prevent no-unreachable-loop crash when all loop types are ignored (#21116) (Pixel)
• e23fafe fix: prefer-object-spread add semicolon when adding parenthesis (#21081) (synthex-byte)
• 20b5ad0 fix: quadratic-time regex in prefer-template (#21096) (Milos Djermanovic)
• 8b6f6c0 fix: apply ignore configs to computed methods in class-methods-use-this (#21094) (Pixel)
• b2c608c fix: NewExpression with parenthesized callee in preserve-caught-error (#21083) (Francesco Trotta)

Documentation

• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106) (Minsu)
• 784dfbe docs: Clarify no-eq-null description (#21120) (Park Harin)
• 7ec733a docs: Fix typos and grammar in glossary (#21095) (Marry (Subin Yang))
• 92bb13f docs: replace quake link (#21108) (Jung Hyeon Jun)
• 68eb4a5 docs: fix broken Specify Globals anchor links in rule pages (#21103) (Minsu)
• d28f697 docs: replace Code Climate CLI links with Qlty CLI links (#21099) (Jung Hyeon Jun)
• eccc68d docs: correct --suppressions-location option description (#21093) (Ga eun Lee)
• c5963f7 docs: Update README (GitHub Actions Bot)

Chores

• 4fbf46d test: pin webpack version to 5.108.4 (#21137) (Francesco Trotta)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101) (Bo Hyun Kim)
• eccbe7b test: add error locations to no-class-assign (#21123) (devoil)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118) (dependabot[bot])
• e9d66d0 ci: bump actions/setup-node from 6 to 7 (#21119) (dependabot[bot])
• ee225b6 test: Add error location details to no-eq-null rule (#21117) (Park Harin)
• 044a627 chore: update minimatch to ^10.2.5 (#21107) (김채영)
• fb09aa8 chore: update ecosystem plugins (#21115) (ESLint Bot)
• 5abd878 test: add error locations to no-proto (#21114) (Gihyeon Jeong / 정기현)
• 9715887 test: Add error location details to no-div-regex (#21110) (Park Harin)
• a746ec6 test: add error locations to no-new-wrappers (#21109) (Gihyeon Jeong / 정기현)
• 8dde645 test: add error locations to no-ex-assign (#21102) (devoil)
• 13ab0ec test: add error locations to no-label-var (#21098) (Gihyeon Jeong / 정기현)
• a99906f test: Add error location details to no-delete-var rule (#21105) (Park Harin)
• c47e8dc chore: add missing backticks to languages/js/index.js (#21104) (beeen)
• 0174428 chore: add missing backticks to translate-cli-options.js (#21097) (dongkyu lee)
• 3d36589 chore: add missing backticks to serialization.js (#21091) (이규환)
• dcc9312 test: add error locations to eqeqeq (#21090) (Ga eun Lee)
• 2710b18 ci: Add explicit permissions to rebuild-docs-sites workflow (#21089) (Marry (Subin Yang))
• 5d2f866 chore: update dependency prettier to v3.9.5 (#21086) (renovate[bot])
• d584e31 chore: fix failing ecosystem test for eslint-plugin-unicorn (#21084) (Francesco Trotta)
• bf3eda0 chore: update ecosystem plugins (#21079) (ESLint Bot)

Commits

• 749dfed 10.8.0
• 4bd0d75 Build: changelog update for 10.8.0
• 4fbf46d test: pin webpack version to 5.108.4 (#21137)
• 6ddf858 docs: fix broken Specify Parser Options anchor link (#21106)
• 784dfbe docs: Clarify no-eq-null description (#21120)
• 6b8d2f7 fix: escape reserved characters in rule id in html formatter (#21129)
• 2d063e2 chore: update HTTP URLs to HTTPS in JSDoc and comments (#21101)
• eccbe7b test: add error locations to no-class-assign (#21123)
• 2fee9bb feat: export ConfigObject from eslint/config (#21082)
• e7d1e43 ci: bump actions/setup-go from 6 to 7 (#21118)
• Additional commits viewable in compare view

Updates fallow from 3.8.0 to 3.10.0

Release notes

Sourced from fallow's releases.

v3.10.0: stable type-aware TypeScript analysis

Stable type-aware TypeScript analysis

--type-aware opts into a bounded TypeScript-Go semantic pass that runs after Fallow's normal project analysis. It landed in 3.8.0 as an explicit, repository-only proof; it is now a stable optional contract with a versioned wire protocol and a packaged companion. Default analysis stays fast, syntactic, and independent of Node.js and TypeScript.

npm install --save-dev fallow
npx fallow dead-code --unused-class-members --type-aware

npm installs receive the exact matching fallow-type-aware companion as an optional dependency, so there is nothing else to wire up. See the type-aware analysis guide.

The pass covers five project-wide capabilities:

• exact symbol-use, TypeScript contract, and validated framework-contract decisions for existing dead-code candidates
• symbol traces across namespaces, aliases, and re-export hops
• package API surfaces and cross-file private type leaks
• exact-symbol impact paths and targeted-test suggestions
• advisory public-signature type coupling

Fallow only changes a finding when the checker resolves an exact declaration identity. Name-only matches are never enough, so dynamic computed access, decorators, dependency injection, and runtime registration keep their findings.

Cross-project confirmation

Explicit TypeScript projects are now scanned together, so a use in an application project can confirm a declaration in a referenced library project. String-literal element access is recognized as a use. Explicit solution configs without source files fail closed with per-candidate abstention instead of emitting invalid project metadata.

Checker-backed API and project metadata

Public API analysis no longer treats parameter names or generic type parameters as private types, complete semantic results drop unmatched syntactic leak guesses, and overlapping TypeScript projects no longer duplicate API entries or coupling edges. Per-project candidate, confirmed, unresolved, and abstained counts are populated instead of staying zero, including in the programmatic API.

Unavailable API queries keep their syntactic leak findings, a missing entry point keeps mixed-entry results partial, requests above the private-leak candidate cap retain the unrequested tail and report partial capacity, and

... (truncated)

Changelog

Sourced from fallow's changelog.

[3.10.0] - 2026-07-27

Changed

• Type-aware class-member refinement now covers string-literal element access and cross-project consumers. Explicit TypeScript projects are scanned together, so a use in an application project can confirm a declaration in a referenced library project. Dynamic computed access, decorators, dependency injection, and runtime registration still retain the finding when exact symbol evidence is unavailable. Explicit solution configs without source files now fail closed with per-candidate abstention instead of invalid project metadata. The release corpus enforces pinned clean sources, repeated deterministic output, independent source review, and accuracy, resource, and abstention limits. Corpus evidence is now produced by the exact hashed sidecar artifact recorded during discovery instead of importing workspace implementation modules.

Fixed

• Type-aware API and project metadata now reflect checker-backed facts. Public API analysis no longer treats parameter names or generic type parameters as private types, complete semantic API results remove unmatched syntactic leak guesses, and overlapping TypeScript projects no longer duplicate API entries or coupling edges. Per-project candidate, confirmed, unresolved, and abstained counts are populated instead of remaining zero, including in the programmatic API. Unavailable API queries retain syntactic leak findings, and a missing entry point keeps mixed-entry results partial. Corpus artifacts now record and verify the approved ancestor dependency environment, including its lockfile and installed type-declaration tree, rather than claiming that fixtures resolve with no dependencies. The semantic protocol is now version 6, the first stable type-aware wire contract. A canonical manifest now keeps Rust, the sidecar, corpus tooling, and editor packaging aligned. Pre-stable protocol variants are rejected. Private leak confirmation is request-scoped and bounded, incomplete entry-point coverage retains syntactic candidates, and unexpected checker failures surface as errors instead of being mislabeled as unsupported syntax. Requests above the private-leak candidate cap retain the unrequested tail and report partial capacity instead of failing or pruning it. The Rust semantic client and reconciliation logic now have one owner in fallow-api; CLI, editor, runtime, and programmatic paths share it. Cross-platform child-process lifecycle behavior is shared through fallow-process.

[3.9.1] - 2026-07-24

Added

• fallow impact statusline exposes a compact, read-only Impact summary for agent status lines. It reports the latest whole-project issue count, its trend from the prior full scan, and the number of findings cleared while

... (truncated)

Commits

• 2881013 test: scope process lint expectation to Unix
• 55d72c0 feat(config): add ignoreFindings to hide findings without removing files from...
• d3b7350 fix(deps): credit dependencies referenced by config callbacks and CLI flags
• cca693b test: avoid global sidecar environment mutation
• d73cee9 fix(graph): preserve TypeScript path aliases excluded by ignorePatterns
• 7667b6a test: share type-aware sidecar launcher
• 11bf96c fix: increase standalone icon safe area
• 7f3aee3 fix: normalize type-aware Windows paths
• 1142d22 test: expose type-aware CLI failure output
• c151c4e fix: make type-aware release validation portable
• Additional commits viewable in compare view

Updates globals from 17.7.0 to 17.8.0

Release notes

Sourced from globals's releases.

v17.8.0

• Update globals (2026-07-01) (#347) 7394811

---

sindresorhus/globals@v17.7.0...v17.8.0

Commits

• 36c7659 17.8.0
• 7394811 Update globals (2026-07-01) (#347)
• See full diff in compare view

Updates tap from 21.7.4 to 21.7.5

Commits

• 88f4b97 update versions
• 3ec7a3f mock: handle cases where an import happens after unmock()
• a186e3c c8@12, update the sync hooks node version req
• ce77a9a run: test list unsorting properly
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[mroderick]

TypeScript, sigh

[mroderick]

Dependency Upgrade Review: npm-deps group (8 updates) — High confidence

Scope: Dependency-only — touches only package.json and package-lock.json. No source changes. Also includes one manual commit adding typescript: ^6.0.3 as a new devDependency.

Package	From	To	Role	Risk
@better-auth/oauth-provider	1.6.24	1.6.25	runtime	Low
@hono/node-server	2.0.11	2.0.12	runtime	Low
hono	4.12.31	4.12.32	runtime	Low
@playwright/test	1.61.1	1.62.0	dev	Low
eslint	10.7.0	10.8.0	dev	Low
fallow	3.8.0	3.10.0	dev	Low
globals	17.7.0	17.8.0	dev	Low
tap	21.7.4	21.7.5	dev	Low

Compatibility: The three runtime deps are patch-level bug fixes on paths this repo uses — hono 4.12.32 makes query/header/param parsing prototype-clean, @hono/node-server copies headers for foreign Response objects, oauth-provider fixes Apple OAuth PKCE, Google One Tap, and adapter query routing. All backward-compatible. Dev deps are minor/patch tooling bumps; the codebase stays JavaScript (e2e/, test/, eslint.config). All compatible.

Note on the new typescript devDep: added to a repo with no .ts source, no tsconfig, and no tsc invocations. Dev-only, so not blocking, but its purpose (likely feeding fallow's type-aware analysis) isn't stated anywhere. Worth a brief comment if it's meant to stay.

Test coverage: CI runs the full suite, lint, smoke, and Playwright e2e — all green on this branch. A regression in any runtime dep would be caught by the integration/feature tests.

Verdict: Approve. Runtime changes are low-risk patch fixes on used paths with strong test coverage.