build(deps): bump the npm_and_yarn group across 1 directory with 2 updates

[dependabot]

Bumps the npm_and_yarn group with 1 update in the /web directory: js-yaml.

Updates @vitest/mocker from 4.1.6 to 5.0.0

Release notes

Sourced from @​vitest/mocker's releases.

v5.0.0

Vitest 5 is officially out! This release focuses on performance and brings a lot of new features while fixing long-standing bugs. See our blog post for the official announcement.

   🚨 Breaking Changes

• Replace loupe.inspect with pretty-format  -  by @​hi-ogawa, Claude Opus 5 (1M context) and OpenAI Codex in vitest-dev/vitest#9609 (3f802)
• Remove quotes from string values in test.for/each title $ variable (take 2)  -  by @​hi-ogawa in vitest-dev/vitest#10170 (04d37)
• Default attachmentsDir from .vitest-attachements/ to .vitest/attachments/  -  by @​MdSadiqMd in vitest-dev/vitest#10186 (1ba73)
• Remove sequential test/suite options in favor of concurrent  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10198 (9229f)
• Represent locator as an object instead of a string  -  by @​sheremet-va in vitest-dev/vitest#10212 (80f07)
• Inline expect package  -  by @​sheremet-va in vitest-dev/vitest#10221 (ad162)
• Remove deprecated entry points  -  by @​sheremet-va in vitest-dev/vitest#10222 (994c6)
• Require Node.js 22 and Vite 6.4  -  by @​sheremet-va in vitest-dev/vitest#10178 (38762)
• Fail expect.poll when function didn't resolve in time  -  by @​hi-ogawa and OpenAI Codex in vitest-dev/vitest#10233 (4df04)
• Throw an error if hoistable methods are outside the top level scope  -  by @​sheremet-va in vitest-dev/vitest#10460 (d0b4f)
• toHaveTextContent is strict, add toMatchTextContent as alternative  -  by @​sheremet-va in vitest-dev/vitest#10473 (18f30)
• Don't lookup config file from ancestor directories  -  by @​hi-ogawa, OpenAI Codex and Hiroshi Ogawa in vitest-dev/vitest#10428 (945d9)
• Inline @vitest/runner package, do not publish it anymore  -  by @​sheremet-va in vitest-dev/vitest#10511 (6d6e4)
• Allow mutating happy-dom/jsdom window object  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10373 (206e8)
• Expose concurrencyId/workerId on TestModule's diagnostics, make id 1-based  -  by @​sheremet-va in vitest-dev/vitest#10516 (bdd98)
• Add screenshotDirectory config to browser.expect.toMatchScreenshot  -  by @​macarie in vitest-dev/vitest#10592 (a60de)
• Update @sinonjs/fake-timers and support mocking Temporal  -  by @​hi-ogawa, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10654 (f8b15)
• Remove webdriverio package  -  by @​sheremet-va in vitest-dev/vitest#10675 (5fed6)
• Clear mocks by default before each test  -  by @​sheremet-va in vitest-dev/vitest#10613 (0f646)
• Don't emit localStorage warnings on Node 26, fail gracefully when worker fails to start  -  by @​sheremet-va in vitest-dev/vitest#10293 (334ed)
• Separate config resolution from the server creation  -  by @​sheremet-va in vitest-dev/vitest#10554 (1c0ec)
• Inline projects extend the root config by default  -  by @​sheremet-va in vitest-dev/vitest#10750 (fec00)
• Enable mocking Temporal without fake timers  -  by @​fabon-f, Hiroshi Ogawa and OpenCode (gpt-5.6-sol) in vitest-dev/vitest#10757 (ac2d4)
• Support nested projects  -  by @​sheremet-va in vitest-dev/vitest#10846 (ec367)
• Use > as separator in -t, calculate only once  -  by @​sheremet-va in vitest-dev/vitest#10686 (a0b20)
• Fail the test when an asynchronous assertion is not awaited  -  by @​sheremet-va in vitest-dev/vitest#10868 (86d4a)
• Share the Vite server between inline projects  -  by @​sheremet-va in vitest-dev/vitest#10848 (d87c9)
• Parse files statically in vitest list by default  -  by @​sheremet-va in vitest-dev/vitest#11088 (51e94)
• benchmark:
  • Rewrite the public API  -  by @​sheremet-va in vitest-dev/vitest#10113 (19f6e)
• browser:
  • Iframe scale  -  by @​macarie in vitest-dev/vitest#9745 (b6398)
  • Enable locators.exact by default  -  by @​sheremet-va in vitest-dev/vitest#10430 (e2032)
  • Require sessionId for orchestrator html request  -  by @​hi-ogawa, Hiroshi Ogawa and OpenAI Codex in vitest-dev/vitest#10522 (79b7d)
  • Save failure screenshots in attachmentsDir  -  by @​macarie in vitest-dev/vitest#10917 (3b5bb)
• coverage:
  • include/exclude globs too eager  -  by @​AriPerkkio in vitest-dev/vitest#9818 (edacb)
  • Allow thresholds.perFile to accept an object  -  by @​vladlenskiy and @​AriPerkkio in vitest-dev/vitest#10190 (13b78)
• expect:
  • Fix toThrow("") behavior by reverting #6710  -  by @​hi-ogawa in vitest-dev/vitest#9643 and vitest-dev/vitest#6710 (6c3e4)
• mocker:
  • Deserialize automock as automock  -  by @​nami8824 in vitest-dev/vitest#10192 (2f892)
• reporters:
  • blob reporter and --merge-reports default to .vitest/blob/  -  by @​AriPerkkio in vitest-dev/vitest#10232 (d22b0)
  • Write json and junit reporter output files to .vitest by default  -  by @​hi-ogawa, Hiroshi Ogawa, OpenCode (gpt-5.6-sol) and @​AriPerkkio in vitest-dev/vitest#10621 (58577)

... (truncated)

Commits

• f441c6f chore: release v5.0.0 (#11130)
• 897f51f chore: release v5.0.0-rc.4 (#11107)
• 7db80dc chore: release v5.0.0-rc.3 (#11089)
• 732df2c fix(deps): update all non-major dependencies (#11043)
• 1e9f80e perf(vm): don't prewarm modules the worker never requests (#11033)
• af83d1b chore: release v5.0.0-rc.2 (#10976)
• 8ff9b9a fix(mocker): restrict redirect mocks to the fs allowlist (#10972)
• 65263d7 fix(deps): update all non-major dependencies (#10966)
• a7fa111 chore: release v5.0.0-rc.1 (#10920)
• 0553851 chore: add Knip checks (#10847)
• Additional commits viewable in compare view

Updates js-yaml from 4.3.1 to 4.3.2

Changelog

Sourced from js-yaml's changelog.

4.3.2 - 2026-08-26

Changed

• [backport] Hard-limit merge sequence size to 100.

Security

• [backport] Count empty mappings in merge sequences toward maxTotalMergeKeys to limit CPU usage, #797.

Commits

• 79ca68d 4.3.2 released
• d90b661 Backport merge limits from v5.4.1
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions
  You can disable automated security fix PRs for this repo from the Security Alerts page.